🦄 Sync 2026-09-13 19:17:01

.github/diy/patches/luci-app-passwall.patch

@@ -240,7 +240,7 @@
 @@ -825,7 +825,7 @@ for k, v in pairs(nodes_table) do
  end
  
- m:appendTemplate("/global/footer", {shunt_list = api.jsonc.stringify(shunt_list)})
+ m:appendTemplate("/global/footer")
 -
 +m:appendTemplate("/global/status_bottom")
  m:appendTemplate("/cbi/sortable", {sectiontype = s2.sectiontype})

.github/diy/patches/luci-app-passwall2.patch

@@ -116,7 +116,7 @@
 @@ -383,7 +383,7 @@ for k, v in pairs(nodes_table) do
  end
  
- m:appendTemplate("/global/footer", {shunt_list = api.jsonc.stringify(shunt_list)})
+ m:appendTemplate("/global/footer")
 -
 +m:appendTemplate("/global/status_bottom")
  m:appendTemplate("/cbi/sortable", {sectiontype = s2.sectiontype})

.github/diy/patches/ssr-plus.patch

@@ -3,7 +3,7 @@
 @@ -33,6 +33,13 @@ LUCI_DEPENDS:= \
  	+libuci-lua +lua +luci-compat +coreutils +coreutils-base64 +dns2tcp +dnsmasq-full \
  	+jq +ip-full +lua-neturl +libuci-lua +microsocks +ipt2socks +lyaml \
- 	+resolveip +curl +nping +unzip +xz-utils +xz \
+ 	+resolveip +bind-dig +curl +nping +unzip +xz-utils +xz \
 +	+PACKAGE_$(PKG_NAME)_INCLUDE_Xray:xray-core \
 +	+PACKAGE_$(PKG_NAME)_INCLUDE_Xray:coreutils-timeout \
 +	+PACKAGE_$(PKG_NAME)_INCLUDE_Http_Proxy:3proxy \

.github/workflows/upstream.yml

@@ -152,6 +152,7 @@ jobs:
         git_clone https://github.com/Tencent-Cloud-Plugins/tencentcloud-openwrt-plugin-cos && mv -n tencentcloud-openwrt-plugin-cos/tencentcloud_cos ./luci-app-tencentcloud-cos; rm -rf tencentcloud-openwrt-plugin-cos
         git_clone https://github.com/doushang/luci-app-shortcutmenu luci-shortcutmenu && mv -n luci-shortcutmenu/luci-app-shortcutmenu ./ ; rm -rf luci-shortcutmenu
         git_clone https://github.com/aa65535/openwrt-dist-luci
+        git_clone https://github.com/minicom365/openwrt-smart-reboot && mv -f openwrt-smart-reboot/*smart-reboot ./;rm -rf openwrt-smart-reboot
         # git_clone https://github.com/morytyann/OpenWrt-msd && mvdir OpenWrt-msd
         # git_clone https://github.com/messense/aliyundrive-webdav aliyundrive && mv -n aliyundrive/openwrt/* ./ ; rm -rf aliyundrive
         # git_clone https://github.com/sbilly/netmaker-openwrt && mv -n netmaker-openwrt/netmaker ./; rm -rf netmaker-openwrt
@@ -176,6 +177,7 @@ jobs:
         git_clone https://github.com/nikkinikki-org/OpenWrt-momo && mv -f OpenWrt-momo/{luci-app-momo,momo} ./;rm -rf OpenWrt-momo
         git_clone https://github.com/fcshark-org/openwrt-fchomo && mvdir openwrt-fchomo
         git clone https://github.com/fw876/helloworld -b dev && mvdir helloworld
+        git_clone https://github.com/umk0/openwrt-luci-haproxy-manager && mv -f openwrt-luci-haproxy-manager/luci-app-haproxy-manager ./;rm -rf openwrt-luci-haproxy-manager
         ) &
         (
         git_clone https://github.com/ZeaKyX/speedtest-web
@@ -208,6 +210,7 @@ jobs:
         git_clone https://github.com/xptsp/luci-app-squid-adv
         git_clone https://github.com/xptsp/openwrt-e2guardian
         git_clone https://github.com/10000ge10000/luci-app-openclaw
+        git_clone https://github.com/WROIATE/luci-app-hijpass
         ) &
         (
         git_clone https://github.com/honwen/luci-app-shadowsocks-rust
@@ -242,6 +245,7 @@ jobs:
         git_sparse_clone master "https://github.com/coolsnowwolf/lede" package/lean package/network/services/shellsync package/qca/shortcut-fe
         git_clone https://github.com/linkease/istore-packages
         git clone https://github.com/laipeng668/luci-app-gecoosac gecoosac1 && mvdir gecoosac1
+        git_clone https://github.com/eamonxg/luci-theme-shadcn
         ) &
         (
         git_clone https://github.com/muink/luci-app-dnsproxy
@@ -388,8 +392,8 @@ jobs:
         (
         git_sparse_clone develop "https://github.com/Ysurac/openmptcprouter-feeds" \
         dsvpn glorytun-udp glorytun grpcurl ipcalc luci-app-dsvpn luci-app-glorytun-tcp luci-app-glorytun-udp luci-app-mail luci-app-mlvpn luci-app-mptcp luci-app-nginx-ha luci-app-sqm-autorate luci-app-packet-capture luci-app-iperf luci-theme-openmptcprouter sqm-autorate speedtestc mlvpn mptcp tcptraceroute tracebox tsping atinout z8102
-        git_sparse_clone chawrt/24.10 "https://github.com/liudf0716/luci" applications/luci-app-yt-dlp applications/luci-app-apfree-wifidog applications/luci-app-ss-redir
-        git_sparse_clone chawrt/24.10 "https://github.com/liudf0716/packages" net/ss-redir
+        git_sparse_clone chawrt/25.12 "https://github.com/liudf0716/luci" applications/luci-app-xkcptun applications/luci-app-apfree-wifidog
+        git_sparse_clone chawrt/25.12 "https://github.com/liudf0716/packages" net/xkcptun net/apfree-wifidog
         ) &
         git_sparse_clone master "https://github.com/immortalwrt/packages" net/n2n net/qbittorrent \
         net/amule net/cdnspeedtest net/minieap net/ddns-go net/sysuh3c net/3proxy utils/filebrowser net/cloudreve \
@@ -465,7 +469,7 @@ jobs:
              -H "Authorization: Bearer ${{ secrets.TOKEN_KIDDIN9 }}" \
              -X POST -d '{ "query": "query {repository(owner: \"'"$1"'\", name: \"'"$2"'\"){latestRelease{tagName tagCommit{oid}}refs(refPrefix:\"refs/tags/\",last:1,orderBy:{field:TAG_COMMIT_DATE,direction:ASC}){edges{node{name target{oid}}}}defaultBranchRef{target{...on Commit {oid}}}}}"}' https://api.github.com/graphql)
         }
-        for pkg in $(ls !(luci-*|nikki|mihomo*|openwrt-einat-ebpf|qBittorrent-Enhanced-Edition|tuic-client|glorytun|dae|daed|shadowsocks-libev|mosdns|spotifyd|miniupnpd|openwrt-Toolkit|libdouble-conversion|wxbase|3proxy|ucode|mergerfs|openwrt-nezhav1|homebox|sub-web|tcptraceroute|frp|openwrt-caddy|mentohust|brlaser|rapidjson|smartdns|hysteria|gecoosac|libcryptopp|naiveproxy|rustdesk-server|shadowsocksr-libev|tuic-server|joker|ps3netsrv|natter|netmaker|openwrt-ympd|subconverter|sms-tool)/Makefile); do
+        for pkg in $(ls !(luci-*|nikki|mihomo*|dockermanager|kaiplus|fastnet|baidudrive|openwrt-einat-ebpf|qBittorrent-Enhanced-Edition|tuic-client|glorytun|dae|daed|shadowsocks-libev|mosdns|spotifyd|miniupnpd|openwrt-Toolkit|libdouble-conversion|wxbase|3proxy|ucode|mergerfs|openwrt-nezhav1|homebox|sub-web|tcptraceroute|frp|openwrt-caddy|mentohust|brlaser|rapidjson|smartdns|hysteria|gecoosac|libcryptopp|naiveproxy|rustdesk-server|shadowsocksr-libev|tuic-server|joker|ps3netsrv|natter|netmaker|openwrt-ympd|subconverter|sms-tool)/Makefile); do
           repo="$(grep ^PKG_SOURCE_URL $pkg | grep github | cut -f 4-5 -d '/' | sed -e 's/.git//' | grep -E '[0-9a-zA-Z_-]+$')" || true
           if [ "$repo" ]; then
             owner="$(echo $repo | cut -f 1 -d '/')"

agentflow/Makefile

@@ -10,12 +10,12 @@ AGENTFLOW_ARCH_x86_64:=amd64
 AGENTFLOW_ARCH_aarch64:=arm64
 AGENTFLOW_ARCH:=$(AGENTFLOW_ARCH_$(ARCH))
 
-AGENTFLOW_HASH_x86_64:=996ccb6580043a187e83a3558c6bb2f0ff503bafbe46b7c995cff7f77629c088
-AGENTFLOW_HASH_aarch64:=6d733ebc49b095bf8670a1b655a13bb8ad98c90ced19701b67d5cdd4fe9a3db4
+AGENTFLOW_HASH_x86_64:=454857022d555b23979bd7b9116ef926ce7117e9e6034116f3223bb72cae07db
+AGENTFLOW_HASH_aarch64:=34dfe07fd2a1bcb7de8eadb41dd0a67b46d5db78f4ca14d1835fe94608c0579a
 
 PKG_NAME:=agentflow
-PKG_VERSION:=0.3.0
-PKG_RELEASE:=8
+PKG_VERSION:=0.3.1
+PKG_RELEASE:=9
 
 AGENTFLOW_URL_FILE:=agentflow-linux-$(AGENTFLOW_ARCH)
 AGENTFLOW_DOWNLOAD:=$(AGENTFLOW_URL_FILE)-$(AGENTFLOW_HASH_$(ARCH))

apfree-wifidog/Makefile

@@ -0,0 +1,70 @@
+#
+# Copyright (C) 2018 Dengfeng Liu
+#
+# This is free software, licensed under the GNU General Public License v3.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=apfree-wifidog
+PKG_VERSION:=9.09.2938
+PKG_RELEASE:=1
+
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
+PKG_SOURCE_URL:=https://codeload.github.com/liudf0716/$(PKG_NAME)/tar.gz/$(PKG_VERSION)?
+PKG_HASH:=skip
+PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)-$(PKG_VERSION)
+
+PKG_MAINTAINER:=Dengfeng Liu <liudf0716@gmail.com>
+PKG_LICENSE:=GPL-3.0-or-later
+PKG_LICENSE_FILES:=COPYING
+
+include $(INCLUDE_DIR)/package.mk
+include $(INCLUDE_DIR)/cmake.mk
+
+define Package/apfree-wifidog
+  SUBMENU:=Captive Portals
+  SECTION:=net
+  CATEGORY:=Network
+	DEPENDS:=+zlib +libjson-c +libevent2 +libevent2-openssl +libuci \
+						+openssl-util +libnetfilter-queue +conntrack +libmosquitto \
+						+libnftnl +libmnl +libbpf +aw-bpf
+  TITLE:=Apfree's wireless captive portal solution
+  URL:=https://github.com/liudf0716/apfree_wifidog
+endef
+
+define Package/apfree-wifidog/description
+  The ApFree Wifidog project is a complete and embeddable captive portal
+  solution for wireless community groups or individuals who wish to open a free
+  Hotspot while still preventing abuse of their Internet connection.
+  It's enhanced wifidog
+endef
+
+define Package/apfree-wifidog/conffiles
+/etc/config/wifidogx
+endef
+
+define Package/apfree-wifidog/install
+	$(INSTALL_DIR) $(1)/usr/bin
+	$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/bin/wifidogx $(1)/usr/bin/wifidogx
+	$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/bin/wdctlx $(1)/usr/bin/wdctlx
+	$(INSTALL_DIR) $(1)/usr/sbin
+	$(INSTALL_DIR) $(1)/etc
+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/wifidog-msg.html $(1)/etc/
+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/wifidog-redir.html $(1)/etc/
+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/wifidog-redir.html.front $(1)/etc/
+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/wifidog-redir.html.rear $(1)/etc/
+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/authserver-offline.html $(1)/etc/
+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/internet-offline.html $(1)/etc/
+	$(INSTALL_DIR) $(1)/etc/init.d
+	$(INSTALL_BIN) ./files/wifidogx.init $(1)/etc/init.d/wifidogx
+	$(INSTALL_DIR) $(1)/etc/config
+	$(CP) ./files/wifidogx.conf $(1)/etc/config/wifidogx
+	$(INSTALL_DIR) $(1)/etc/wifidogx
+	$(INSTALL_DIR) $(1)/www/cgi-bin
+	$(INSTALL_BIN) $(PKG_BUILD_DIR)/wifi-config $(1)/www/cgi-bin/
+	$(INSTALL_BIN) $(PKG_BUILD_DIR)/wifi-diag $(1)/www/cgi-bin/
+endef
+
+$(eval $(call BuildPackage,apfree-wifidog))

apfree-wifidog/README.md

@@ -0,0 +1,125 @@
+![ApFreeWiFiDog](https://github.com/liudf0716/apfree_wifidog/blob/master/logo.png)
+
+
+[![license][1]][2]
+[![PRs Welcome][3]][4]
+[![Issues Welcome][5]][6]
+[![Release Version][7]][8]
+[![OpenWrt][11]][12]
+[![Join the QQ Group][15]][16]
+
+
+[1]: https://img.shields.io/badge/license-GPLV3-brightgreen.svg?style=plastic
+[2]: https://github.com/liudf0716/apfree_wifidog/blob/master/COPYING
+[3]: https://img.shields.io/badge/PRs-welcome-brightgreen.svg?style=plastic
+[4]: https://github.com/liudf0716/apfree_wifidog/pulls
+[5]: https://img.shields.io/badge/Issues-welcome-brightgreen.svg?style=plastic
+[6]: https://github.com/liudf0716/apfree_wifidog/issues/new
+[7]: https://img.shields.io/badge/release-3.11.1716-red.svg?style=plastic
+[8]: https://github.com/liudf0716/apfree_wifidog/releases
+[11]: https://img.shields.io/badge/Platform-%20OpenWrt%7C%20LEDE%20-brightgreen.svg?style=plastic
+[12]: https://github.com/KunTengRom/kunteng-lede-17.01.4
+[13]: https://img.shields.io/badge/KunTeng-Inside-blue.svg?style=plastic
+[14]: https://www.kunteng.org.cn
+[15]: https://img.shields.io/badge/chat-qq%20group-brightgreen.svg
+[16]: https://jq.qq.com/?_wv=1027&k=4ADDSev
+
+## ApFree WiFiDog: A high performance captive portal solution for HTTP(s)
+
+ApFree WiFiDog is a high performance captive portal solution for HTTP(s), which mainly used in ([LEDE](https://github.com/lede-project/source) & [OpenWrt](https://github.com/openwrt/openwrt)) platform. 
+
+
+**[中文介绍](https://github.com/liudf0716/apfree_wifidog/blob/master/README_ZH.md)**
+
+## Enhancement of apfree-wifidog 
+
+In fact, the title should be why we choose apfree-wifidog, the reason was the following: 
+
+>  Stable
+
+apfree-wifidog was widely used in tens of thousands device, which were running in business scene. In order to improve its stable, we rewrite all iptables rule by api instead of fork call, which will easily cause deadlock in multithread-fork running environment. we also re-write the code and replace libhttpd (which is unmaintained for years) with libevent
+
+> Performance
+
+apfree-wifidog's http request-response is more quick, u can find statistic data in our test document
+
+> HTTPs redirect
+
+apfree-wifidog support https redirect, in current internet environment, captive portal solution without supporting https redirect will become unsuitable gradually
+
+
+> More features
+
+apfree-wifidog support mac temporary-pass, ip,domain,pan-domain,white-mac,black-mac rule and etc. all these rules can be applied without restarting wifidog
+
+> MQTT support
+
+by enable mqtt support, u can remotely deliver such as trusted ip, domain and pan-domain rules to apfree wifidog 
+
+> Compilable with wifidog protocol
+
+u don't need to modify your wifidog authentication server to adapt apfree-wifidog; if u have pression on server-side, apfree wifidog's improved protocol can greatly relieve it, which disabled by default
+
+
+## Getting started
+
+before starting apfree-wifidog, we must know how to configure it. apfree-wifidog use OpenWrt standard uci config system, all your apfree-wifidog configure information stored in `/etc/confg/wifidogx`, which will be parsed by  `/etc/init.d/wifidogx` to /tmp/wifidog.conf, apfree-wifidog's real configure file is `/tmp/wifidog.conf`
+
+The default apfree-wifidog UCI configuration file like this:
+
+```
+config wifidog
+    option  gateway_interface   'br-lan'
+    option  auth_server_hostname    'wifidog.kunteng.org.cn'
+    option  auth_server_port    443
+    option  auth_server_path    '/wifidog/'
+    option  check_interval      60
+    option  client_timeout      5
+    option  apple_cna           1
+    option  thread_number       5
+    option  wired_passed        0
+    option  enable      0
+```
+
+> auth_server_hostname was apfree-wifidog auth server, it can be domain or ip; wifidog.kunteng.org.cn is a free auth server we provided, it was also [open source](https://github.com/wificoin-project/wwas) 
+
+> apple_cna 1 apple captive detect deceive; 2 apple captive detect deceive to  disallow portal page appear
+
+> wired_passed means whether LAN access devices need to auth or not, value 1 means no need to auth 
+
+> enable means whether start apfree-wifidog when we executed `/etc/init.d/wifidogx start`, if u wanted to start apfree-wifidog, you must set enable to 1 before executing `/etc/init.d/wifidogx start`
+
+### How to support https redirect
+
+In order to support https redirect, apfree-wifidog need x509 pem cert and private key, u can generate yourself like this:
+
+```
+PX5G_BIN="/usr/sbin/px5g"
+OPENSSL_BIN="/usr/bin/openssl"
+APFREE_CERT="/etc/apfree.crt"
+APFREE_KEY="/etc/apfree.key"
+
+generate_keys() {
+    local days bits country state location commonname
+
+    # Prefer px5g for certificate generation (existence evaluated last)
+    local GENKEY_CMD=""
+    local UNIQUEID=$(dd if=/dev/urandom bs=1 count=4 | hexdump -e '1/1 "%02x"')
+    [ -x "$OPENSSL_BIN" ] && GENKEY_CMD="$OPENSSL_BIN req -x509 -sha256 -outform pem -nodes"
+    [ -x "$PX5G_BIN" ] && GENKEY_CMD="$PX5G_BIN selfsigned -pem"
+    [ -n "$GENKEY_CMD" ] && {
+        $GENKEY_CMD \
+            -days ${days:-730} -newkey rsa:${bits:-2048} -keyout "${APFREE_KEY}.new" -out "${APFREE_CERT}.new" \
+            -subj /C="${country:-CN}"/ST="${state:-localhost}"/L="${location:-Unknown}"/O="${commonname:-ApFreeWiFidog}$UNIQUEID"/CN="${commonname:-ApFreeWiFidog}"
+        sync
+        mv "${APFREE_KEY}.new" "${APFREE_KEY}"
+        mv "${APFREE_CERT}.new" "${APFREE_CERT}"
+    }
+}
+
+```
+
+or when u start `/etc/init.d/wifidogx start`, it will generate it automatically
+
+
+For more information, please refer to the upstream [project page](https://github.com/liudf0716/apfree_wifidog)

apfree-wifidog/files/wifidogx.conf

@@ -0,0 +1,39 @@
+config wifidogx 'common'
+	option external_interface 'wan'
+	option check_interval '60'
+	option client_timeout '60'
+	option wired_passed '1'
+	option enabled '1'
+	option log_level '0'
+	option js_filter '1'
+	option apple_cna '1'
+	option auth_server_mode 'local'
+	option enable_anti_nat '0'
+	option ttl_values '64,128,255'
+	option ap_device_id 'AW85844955CC7D742A339'
+	option ap_mac_address '5C-C7-D7-42-A3-39'
+	option ap_longitude '116.395000'
+	option ap_latitude '039.911000'
+	option disable_portal_auth '0'
+	option enable_privileged_ops '0'
+	option privileged_ops_secret 'chawrt@2026'
+	option device_id 'AW58534605CC7D742A339'
+	option local_portal 'https://qq.com'
+
+config gateway 'apfree'
+	option gateway_name 'br-lan'
+	option gateway_channel 'apfree'
+	option gateway_auth_enabled '1'
+	option gateway_id '5CC7D742A336'
+	option gateway_subnetv4 '192.168.8.1/24'
+
+config auth 'local'
+	option auth_server_hostname '192.168.8.109'
+	option auth_server_port '8001'
+	option auth_server_path '/wifidog/'
+
+config longconn 'openclaw'
+	option long_conn_mode 'ws'
+	option ws_server_hostname '192.168.8.109'
+	option ws_server_port '8001'
+	option ws_server_path '/ws/wifidogx'

apfree-wifidog/files/wifidogx.init

@@ -0,0 +1,304 @@
+#!/bin/sh /etc/rc.common
+# Copyright (C) 2018 Dengfeng Liu
+
+# After aw-bpf (START=98) so dns_ringbuf_portal is pinned for wildcard trust.
+START=99
+USE_PROCD=1
+NAME=wifidogx
+PROG="/usr/bin/${NAME}"
+CONFIGFILE="/tmp/wifidogx.conf"
+
+handle_gateway() {
+	local section="$1"
+	local gateway_name gateway_channel gateway_id
+	local gateway_subnetv4
+	local gateway_auth_enabled
+
+	config_get gateway_name "$section" gateway_name
+	config_get gateway_channel "$section" gateway_channel
+	config_get gateway_id "$section" gateway_id
+	config_get gateway_auth_enabled "$section" gateway_auth_enabled 1
+
+
+	if [ -z "$gateway_name" ] || [ -z "$gateway_channel" ] ; then
+		echo "gateway_name and gateway_channel  are required for $section" >&2
+		return
+	fi
+
+	# Get gateway_id from gateway_name if not set
+	if [ -z "$gateway_id" ]; then
+		gateway_id=$(ifconfig "$gateway_name" | awk '/HWaddr/ {print toupper($5)}' | tr -d ':')
+		if [ -z "$gateway_id" ]; then
+			echo "Failed to get gateway_id for $gateway_name" >&2
+			return
+		fi
+		uci set wifidogx."$section".gateway_id="$gateway_id"
+		uci commit wifidogx
+	fi
+	# according to the gateway_name to get the subnetv4
+	local gateway_ipv4=$(ifconfig "$gateway_name" | awk '/inet addr:/ {print $2}' | cut -d: -f2)
+	local gateway_maskv4=$(ifconfig "$gateway_name" | awk '/Mask:/ {print $4}' | cut -d: -f2)
+	[ -z "$gateway_ipv4" ] && echo "Failed to get gateway_ipv4 for $gateway_name" >&2 && return
+	[ -z "$gateway_maskv4" ] && echo "Failed to get gateway_maskv4 for $gateway_name" >&2 && return
+
+	# change the gateway_ip4/gateway_maskv4 to CIDR format
+	local mask_bits=0
+	local mask_value=$(printf '%d' "0x$(echo $gateway_maskv4 | tr '.' ' ' | awk '{printf "%02x%02x%02x%02x",$1,$2,$3,$4}')")
+	while [ $mask_value -ne 0 ]; do
+		mask_bits=$((mask_bits + (mask_value & 1)))
+		mask_value=$((mask_value >> 1))
+	done
+	gateway_subnetv4="$gateway_ipv4/$mask_bits"
+	
+	uci set wifidogx."$section".gateway_subnetv4="$gateway_subnetv4"
+	uci commit wifidogx
+
+	printf "GatewaySetting {\n\tGatewayAuthEnabled %s\n\tGatewayInterface %s\n\tGatewayChannel %s\n\tGatewayID %s\n\tGatewaySubnetV4 %s\n}\n" \
+		 "${gateway_auth_enabled}" "${gateway_name}" "${gateway_channel}" "${gateway_id}" "${gateway_subnetv4}" >> "$CONFIGFILE"
+}
+
+add_white_list_entries() {
+	local list_type="$1"
+	local uci_field="$2"
+	local target_variable="$3"
+
+	list_type=$(uci get wifidogx.common."$list_type")
+	for group in $list_type; do
+		group_list=$(uci get wifidogx."$group"."$uci_field")
+		if [ -n "$group_list" ]; then
+			eval "$target_variable=\"\${$target_variable} \$group_list\""
+		fi
+	done
+}
+
+prepare_common_settings() {
+	printf "CheckInterval %s\nClientTimeout %s\nJsFilter %s\nWiredPassed %s\nBypassAppleCNA %s\n" \
+		"$check_interval" "$client_timeout" "$js_filter" "$wired_passed" "$apple_cna" >> "$CONFIGFILE"
+	
+	printf "EnableAntiNat %s\n" "$enable_anti_nat" >> "$CONFIGFILE"
+	printf "TTLValues %s\n" "$ttl_values" >> "$CONFIGFILE"
+	printf "DisablePortalAuth %s\n" "$disable_portal_auth" >> "$CONFIGFILE"
+	printf "EnablePrivilegedOps %s\n" "$enable_privileged_ops" >> "$CONFIGFILE"
+	[ -n "$privileged_ops_secret" ] && printf "PrivilegedOpsSecret %s\n" "$privileged_ops_secret" >> "$CONFIGFILE"
+
+	[ -n "$anti_nat_permit_macs" ] && printf "AntiNatPermitMACs %s\n" "$anti_nat_permit_macs" >> "$CONFIGFILE"
+	
+	process_trusted_list() {
+		local list="$1"
+		local config_name="$2"
+		
+		if [ -n "$list" ]; then
+			# Clean up whitespace and remove duplicates
+			list=$(echo "$list" | sed -e 's/^[[:space:]]*//;s/[[:space:]]*$//;s/[[:space:]]\+/ /g' \
+				| tr ' ' '\n' | sort -u | tr '\n' ',' | sed 's/,$//')
+			printf "%s %s\n" "$config_name" "$list" >> "$CONFIGFILE"
+		fi
+	}
+
+	process_trusted_list "$trusted_domains" "TrustedDomains"
+	process_trusted_list "$trusted_macs" "TrustedMACList"
+	process_trusted_list "$trusted_wildcard_domains" "TrustedWildcardDomains"
+}
+
+prepare_device_info() {
+	# Check if any device info fields are set
+	if [ -n "$ap_device_id" ] || [ -n "$ap_mac_address" ] || [ -n "$ap_longitude" ] || [ -n "$ap_latitude" ] || [ -n "$location_id" ]; then
+		printf "DeviceInfo {\n" >> "$CONFIGFILE"
+		
+		[ -n "$ap_device_id" ] && printf "\tApDeviceId %s\n" "$ap_device_id" >> "$CONFIGFILE"
+		[ -n "$ap_mac_address" ] && printf "\tApMacAddress %s\n" "$ap_mac_address" >> "$CONFIGFILE"
+		[ -n "$ap_longitude" ] && printf "\tApLongitude %s\n" "$ap_longitude" >> "$CONFIGFILE"
+		[ -n "$ap_latitude" ] && printf "\tApLatitude %s\n" "$ap_latitude" >> "$CONFIGFILE"
+		[ -n "$location_id" ] && printf "\tLocationId %s\n" "$location_id" >> "$CONFIGFILE"
+		
+		printf "}\n" >> "$CONFIGFILE"
+	fi
+}
+
+prepare_auth_server_settings() {
+	# 获取选中的认证服务器配置
+	local selected_auth_server
+	selected_auth_server=$(uci get wifidogx.common.selected_auth_server 2>/dev/null)
+	
+	# 如果是云认证或旁路模式，需要验证选中的认证服务器
+	if [ "$auth_server_mode" = "cloud" ] || [ "$auth_server_mode" = "bypass" ]; then
+		if [ -z "$selected_auth_server" ]; then
+			echo "Error: selected_auth_server is required for $auth_server_mode mode" >&2
+			return 1
+		fi
+		
+		local auth_server_hostname auth_server_port auth_server_path
+		
+		uci_validate_section "$NAME" "auth" "$selected_auth_server" \
+			'auth_server_hostname:string:192.168.1.1' \
+			'auth_server_port:port:80' \
+			'auth_server_path:string:/wifidog/'
+		
+		export auth_server_hostname
+		export auth_server_port
+		export auth_server_path
+	fi
+	
+	case "$auth_server_mode" in
+	cloud|bypass)
+		printf "AuthServerMode 0\n" >> "$CONFIGFILE"
+		printf "DeviceID %s\nAuthServer {\n\tHostname %s\n\tHTTPPort %s\n\tPath %s\n}\n" \
+			"$device_id" "$auth_server_hostname" "$auth_server_port" "$auth_server_path" >> "$CONFIGFILE"
+		;;
+	local)
+		printf "AuthServerMode 2\n" >> "$CONFIGFILE"
+		[ -n "$device_id" ] && printf "DeviceID %s\n" "$device_id" >> "$CONFIGFILE"
+		[ -n "$auth_server_offline_file" ] && printf "AuthServerOfflineFile %s\n" "$auth_server_offline_file" >> "$CONFIGFILE"
+		[ -n "$local_portal" ] && printf "LocalPortal %s\n" "$local_portal" >> "$CONFIGFILE"
+		;;
+	esac
+
+	[ -n "$internet_offline_file" ] && printf "InternetOfflineFile %s\n" "$internet_offline_file" >> "$CONFIGFILE"
+}
+
+prepare_longconn_settings() {
+	local long_conn_mode ws_server_hostname ws_server_port ws_server_path
+	local mqtt_server_hostname mqtt_server_port mqtt_username mqtt_password
+	local selected_long_conn
+
+	selected_long_conn=$(uci get wifidogx.common.selected_long_conn 2>/dev/null)
+	[ -z "$selected_long_conn" ] && return
+
+	if ! uci -q get wifidogx."$selected_long_conn" >/dev/null; then
+		echo "Long connection: selected section $selected_long_conn does not exist" >&2
+		return
+	fi
+
+	uci_validate_section "$NAME" "longconn" "$selected_long_conn" \
+		'long_conn_mode:or("ws","wss","mqtt","mqtts"):ws' \
+		'ws_server_hostname:string' \
+		'ws_server_port:port:443' \
+		'ws_server_path:string:/ws/wifidogx' \
+		'mqtt_server_hostname:string' \
+		'mqtt_server_port:port:1883' \
+		'mqtt_username:string' \
+		'mqtt_password:string'
+
+	case "$long_conn_mode" in
+	ws|wss)
+		if [ -z "$ws_server_hostname" ]; then
+			echo "Long connection: ws_server_hostname is required" >&2
+			return
+		fi
+		local ws_ssl
+		ws_ssl=$([ "$long_conn_mode" = "wss" ] && echo 1 || echo 0)
+		printf "WebSocket {\n\tWSServer %s\n\tWSServerPort %s\n\tWSServerPath %s\n\tWSServerSSL %s\n}\n" \
+			"$ws_server_hostname" "$ws_server_port" "$ws_server_path" "$ws_ssl" >> "$CONFIGFILE"
+		;;
+	mqtt|mqtts)
+		if [ -z "$mqtt_server_hostname" ]; then
+			echo "Long connection: mqtt_server_hostname is required" >&2
+			return
+		fi
+		local mqtt_ssl
+		mqtt_ssl=$([ "$long_conn_mode" = "mqtts" ] && echo 1 || echo 0)
+		printf "mqtt {\n\tserveraddr %s\n\tserverport %s\n\tmqttUseSSL %s\n\tmqttUsername %s\n\tmqttPassword %s\n}\n" \
+			"$mqtt_server_hostname" "$mqtt_server_port" "$mqtt_ssl" "${mqtt_username:-}" "${mqtt_password:-}" >> "$CONFIGFILE"
+		;;
+	esac
+}
+
+prepare_external_interface() {
+	[ -z "$external_interface" ] && echo "No ExternalInterface " >&2 && return
+	local external_interface_name
+
+	if [ "$external_interface" = "wwan" ]; then
+		external_interface_name=$(ubus call network.interface."$external_interface" status | jsonfilter -e '@.device')
+	else
+		external_interface_name=$(uci get network."$external_interface".device)
+	fi
+
+	[ -z "$external_interface_name" ] && echo "Failed to get device name for $external_interface" >&2 && return
+  
+	printf "ExternalInterface %s\n" "$external_interface_name" >> "$CONFIGFILE"
+}
+
+prepare_wifidog_conf() {
+	[ -f "$CONFIGFILE" ] && rm -f "$CONFIGFILE"
+	local auth_server_mode_value='"cloud", "bypass", "local"'
+	
+	# 获取选中的认证服务器
+	local selected_auth_server
+	selected_auth_server=$(uci get wifidogx.common.selected_auth_server 2>/dev/null)
+	
+    
+	uci_validate_section "$NAME" "$NAME" common \
+		'enabled:bool:0' \
+		"auth_server_mode:or($auth_server_mode_value)" \
+		'selected_auth_server:string' \
+		'selected_long_conn:string' \
+		'log_level:integer:7' \
+		'device_id:string' \
+		'check_interval:integer:60' \
+		'client_timeout:integer:5' \
+		'wired_passed:bool:1' \
+		'apple_cna:bool:0' \
+		'trusted_domains:list(host)' \
+		'trusted_wildcard_domains:list(string)' \
+		'trusted_macs:list(string)' \
+		'app_white_list:list(string)' \
+		'mac_white_list:list(string)' \
+		'wildcard_white_list:list(string)' \
+		'js_filter:bool:1' \
+		'auth_server_offline_file:string' \
+		'internet_offline_file:string' \
+		'local_portal:string' \
+		'external_interface:string'	\
+		'enable_anti_nat:bool:0' \
+		'enable_privileged_ops:bool:0' \
+		'privileged_ops_secret:string:chawrt@2026' \
+		'ttl_values:string:64,128' \
+		'anti_nat_permit_macs:string' \
+		'disable_portal_auth:bool:1' \
+		'ap_device_id:string' \
+		'ap_mac_address:string' \
+		'ap_longitude:string' \
+		'ap_latitude:string' \
+		'location_id:string'
+
+	[ -n "$app_white_list" ] && add_white_list_entries "app_white_list" "domain_name" "trusted_domains"
+	[ -n "$mac_white_list" ] && add_white_list_entries "mac_white_list" "mac_address" "trusted_macs"
+	[ -n "$wildcard_white_list" ] && add_white_list_entries "wildcard_white_list" "wildcard_domain" "trusted_wildcard_domains"
+
+	prepare_external_interface
+	prepare_auth_server_settings
+	prepare_longconn_settings
+	prepare_device_info
+	config_foreach handle_gateway gateway
+	prepare_common_settings
+}
+
+service_triggers() {
+	procd_add_reload_trigger "wifidogx"
+}
+
+start_service() {
+	config_load "$NAME"
+
+	prepare_wifidog_conf
+
+	if [ "$enabled" -eq 0 ]; then
+		echo "wifidogx is disabled, exit..." >&2
+		return
+	fi
+
+	procd_open_instance
+	procd_set_param command "$PROG" -c "$CONFIGFILE" -s -f -d "$log_level"
+	procd_set_param respawn
+	procd_set_param file /etc/config/wifidogx
+	procd_close_instance
+}
+
+status_service() {
+	/usr/bin/wdctlx status
+}
+
+reload_service() {
+	stop
+	start
+}

baidudrive/Makefile

@@ -10,8 +10,8 @@ include $(TOPDIR)/rules.mk
 PKG_ARCH_BAIDUDRIVE:=$(ARCH)
 
 PKG_NAME:=baidudrive
-PKG_VERSION:=linkeasefull-runtime-v3.0.17
-PKG_RELEASE:=19
+PKG_VERSION:=1.0.6
+PKG_RELEASE:=21
 PKG_SOURCE:=$(PKG_NAME)-binary-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://github.com/istoreos/istoreos-app-hub/releases/download/baidudrive-runtime-v$(PKG_VERSION)/
 PKG_HASH:=skip

dae/Makefile

@@ -5,10 +5,10 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=dae
-PKG_VERSION:=2026.08.28
-PKG_RELEASE:=41
+PKG_VERSION:=2026.09.06
+PKG_RELEASE:=43
 
-PKG_SOURCE:=dae-src-2026.08.28-d6aca8a10b35.tar.gz
+PKG_SOURCE:=dae-src-2026.09.06-80525dabf966.tar.gz
 PKG_SOURCE_URL:=https://github.com/kenzok8/openwrt-daede/releases/download/dae-src
 PKG_SOURCE_SUBDIR:=$(PKG_NAME)-$(PKG_VERSION)
 PKG_HASH:=skip

daed/Makefile

@@ -5,10 +5,10 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=daed
-PKG_VERSION:=2026.08.28
-PKG_RELEASE:=52
+PKG_VERSION:=2026.09.06
+PKG_RELEASE:=54
 
-PKG_SOURCE:=daed-src-2026.08.28-73f01b995c34.tar.gz
+PKG_SOURCE:=daed-src-2026.09.06-62f2e24ac52a.tar.gz
 PKG_SOURCE_URL:=https://github.com/kenzok8/openwrt-daede/releases/download/daed-src
 PKG_SOURCE_SUBDIR:=$(PKG_NAME)-$(PKG_VERSION)
 PKG_HASH:=skip

dockermanager/Makefile

@@ -9,8 +9,8 @@ include $(TOPDIR)/rules.mk
 PKG_ARCH_DOCKERMANAGER:=$(ARCH)
 
 PKG_NAME:=dockermanager
-PKG_VERSION:=linkeasefull-runtime-v3.0.17
-PKG_RELEASE:=5
+PKG_VERSION:=0.1.1
+PKG_RELEASE:=7
 PKG_SOURCE:=$(PKG_NAME)-binary-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://github.com/istoreos/istoreos-app-hub/releases/download/dockermanager-runtime-v$(PKG_VERSION)/
 PKG_HASH:=skip

fastnet/Makefile

@@ -9,15 +9,14 @@ include $(TOPDIR)/rules.mk
 PKG_ARCH_FASTNET:=$(ARCH)
 
 PKG_NAME:=fastnet
-# use PKG_SOURCE_DATE instead of PKG_VERSION for compatible
-PKG_SOURCE_DATE:=0.7.2
-PKG_RELEASE:=2
+PKG_VERSION:=0.7.7
+PKG_RELEASE:=4
 
-PKG_SOURCE:=$(PKG_NAME)-binary-$(PKG_SOURCE_DATE).tar.gz
-PKG_SOURCE_URL:=http://dl.istoreos.com/binary/fastnet/
+PKG_SOURCE:=$(PKG_NAME)-binary-$(PKG_VERSION).tar.gz
+PKG_SOURCE_URL:=https://github.com/istoreos/istoreos-app-hub/releases/download/fastnet-runtime-v$(PKG_VERSION)/
 PKG_HASH:=skip
 
-PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)-binary-$(PKG_SOURCE_DATE)
+PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)-binary-$(PKG_VERSION)
 
 PKG_BUILD_PARALLEL:=1
 PKG_USE_MIPS16:=0
@@ -30,7 +29,6 @@ define Package/$(PKG_NAME)
 	SUBMENU:=Web Servers/Proxies
 	TITLE:=FastNet - network test Web UI
 	DEPENDS:=@(arm||x86_64||aarch64)
-	PKGARCH:=all
 endef
 
 define Package/$(PKG_NAME)/description
@@ -57,7 +55,7 @@ endef
 
 define Package/$(PKG_NAME)/install
 	$(INSTALL_DIR) $(1)/usr/sbin $(1)/etc/config $(1)/etc/init.d $(1)/etc/uci-defaults
-	$(INSTALL_BIN) $(PKG_BUILD_DIR)/fastnet.$(PKG_ARCH_FASTNET) $(1)/usr/sbin/fastnet
+	$(INSTALL_BIN) $(PKG_BUILD_DIR)/FastNet.$(PKG_ARCH_FASTNET) $(1)/usr/sbin/FastNet
 	$(INSTALL_CONF) ./files/fastnet.config $(1)/etc/config/fastnet
 	$(INSTALL_BIN) ./files/fastnet.init $(1)/etc/init.d/fastnet
 	$(INSTALL_BIN) ./files/fastnet.uci-default $(1)/etc/uci-defaults/fastnet

fastnet/files/fastnet.init

@@ -20,7 +20,7 @@ start_service() {
 
 	procd_open_instance
 	procd_set_param limits nofile="65535 65535"
-	procd_set_param command /usr/sbin/fastnet web --addr "$addr" --no-open
+	procd_set_param command /usr/sbin/FastNet web --addr "$addr" --no-open
 	[ -n "$token" ] && procd_append_param command --token "$token"
 	[ "$logger" = 1 ] && procd_set_param stderr 1
 	procd_set_param respawn

frp/Makefile

@@ -2,7 +2,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=frp
 PKG_VERSION:=0.71.0
-PKG_RELEASE:=6
+PKG_RELEASE:=10
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://codeload.github.com/fatedier/frp/tar.gz/v$(PKG_VERSION)?

frp/files/frpc.config

@@ -1,4 +1,5 @@
 config init
+	option enabled '0'
 	option stdout '1'
 	option stderr '1'
 #	Uncomment to run frpc as an existing user/group. Keep disabled by

frp/files/frpc.init

@@ -912,6 +912,7 @@ service_triggers() {
 
 start_service() {
 	local init_cfg=
+	local enabled=0
 	local stdout=1
 	local stderr=1
 	local respawn=1
@@ -919,14 +920,19 @@ start_service() {
 	local run_group=
 	local old_umask
 
-	mkdir -p /var/etc
-	_TOML_ERR=0
-	_ALLOW_UNSAFE_TOKEN_SOURCE_EXEC=0
-
 	config_load "$NAME"
 
 	config_foreach _find_init_section init
 
+	if [ -n "$init_cfg" ]; then
+		config_get_bool enabled "$init_cfg" enabled 0
+	fi
+	[ "$enabled" -eq 1 ] || return 0
+
+	mkdir -p /var/etc
+	_TOML_ERR=0
+	_ALLOW_UNSAFE_TOKEN_SOURCE_EXEC=0
+
 	old_umask="$(umask)"
 	umask 077
 	: > "$CONF_FILE" || {
@@ -950,6 +956,7 @@ start_service() {
 
 	if [ -n "$init_cfg" ]; then
 		config_list_foreach "$init_cfg" conf_inc _append_conf_file
+		[ "$_TOML_ERR" = "0" ] || return 1
 
 		config_get_bool stdout "$init_cfg" stdout 1
 		config_get_bool stderr "$init_cfg" stderr 1

frp/files/frpc.uci-defaults

@@ -79,6 +79,7 @@ upgrade_init() {
 		changed=1
 	fi
 
+	set_if_empty "$init_section" enabled 1
 	set_if_empty "$init_section" stdout 1
 	set_if_empty "$init_section" stderr 1
 	set_if_empty "$init_section" respawn 1

frp/files/frps.config

@@ -1,4 +1,5 @@
 config init
+	option enabled '0'
 	option stdout '1'
 	option stderr '1'
 #	Uncomment to run frps as an existing user/group. Keep disabled by
@@ -18,7 +19,6 @@ config init
 config conf 'common'
 	option bind_addr '0.0.0.0'
 	option bind_port '7000'
-
 	option authentication_method 'token'
 #	option token 'your_token'
 #	Alternatively, load a token from a file or command. Exec token sources
@@ -31,12 +31,10 @@ config conf 'common'
 #	list token_source_exec_args '--format'
 #	list token_source_exec_args 'raw'
 #	list token_source_exec_env 'TOKEN_SERVICE=production'
-
 	option max_pool_count '5'
 	option tcp_mux 'true'
 	option tls_force 'false'
 	option detailed_errors_to_client 'true'
-
 	# Web server is disabled when admin_port is empty or 0.
 #	option admin_addr '127.0.0.1'
 #	option admin_port '7500'
@@ -47,15 +45,12 @@ config conf 'common'
 	option enable_prometheus 'false'
 #	option admin_tls_cert_file '/etc/ssl/acme/example.com.fullchain.crt'
 #	option admin_tls_key_file '/etc/ssl/acme/example.com.key'
-
 #	Allow ports can be single ports or ranges.
 #	list allow_ports '2000-3000'
 #	list allow_ports '3001'
-
 	option log_file 'console'
 	option log_level 'info'
 	option log_max_days '3'
-
 #	List options with name "_" will be directly appended as raw TOML lines.
 #	Use this only for options not covered by UCI options above.
 #	Do not duplicate keys generated by UCI options above.
@@ -68,7 +63,6 @@ config conf 'common'
 #	option path '/handler'
 #	list ops 'Login'
 #	option tls_verify 'false'
-
 #config http_plugin 'port_manager'
 #	option name 'port-manager'
 #	option addr '127.0.0.1:9001'

frp/files/frps.init

@@ -689,6 +689,7 @@ service_triggers() {
 
 start_service() {
 	local init_cfg=
+	local enabled=0
 	local stdout=1
 	local stderr=1
 	local respawn=1
@@ -696,14 +697,19 @@ start_service() {
 	local run_group=
 	local old_umask
 
-	mkdir -p /var/etc
-	_TOML_ERR=0
-	_ALLOW_UNSAFE_TOKEN_SOURCE_EXEC=0
-
 	config_load "$NAME"
 
 	config_foreach _find_init_section init
 
+	if [ -n "$init_cfg" ]; then
+		config_get_bool enabled "$init_cfg" enabled 0
+	fi
+	[ "$enabled" -eq 1 ] || return 0
+
+	mkdir -p /var/etc
+	_TOML_ERR=0
+	_ALLOW_UNSAFE_TOKEN_SOURCE_EXEC=0
+
 	old_umask="$(umask)"
 	umask 077
 	: > "$CONF_FILE" || {
@@ -727,6 +733,7 @@ start_service() {
 
 	if [ -n "$init_cfg" ]; then
 		config_list_foreach "$init_cfg" conf_inc _append_conf_file
+		[ "$_TOML_ERR" = "0" ] || return 1
 
 		config_get_bool stdout "$init_cfg" stdout 1
 		config_get_bool stderr "$init_cfg" stderr 1

frp/files/frps.uci-defaults

@@ -90,6 +90,7 @@ upgrade_init() {
 		changed=1
 	fi
 
+	set_if_empty "$init_section" enabled 1
 	set_if_empty "$init_section" stdout 1
 	set_if_empty "$init_section" stderr 1
 	set_if_empty "$init_section" respawn 1

gecoosac/Makefile

@@ -2,7 +2,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=gecoosac
 PKG_VERSION:=2.2.20251015
-PKG_RELEASE:=20
+PKG_RELEASE:=21
 
 PKG_MAINTAINER:=Roc Lai <laipeng668@qq.com>
 PKG_LICENSE:=AGPL-3.0-only
@@ -43,8 +43,8 @@ define Package/$(PKG_NAME)
   CATEGORY:=Network
   TITLE:=gecoosac server (version $(PKG_VERSION))
   URL:=http://www.cnrouter.com/
-  DEPENDS:=@(aarch64||arm||i386||mips||mipsel||x86_64) +openssl-util
-  PROVIDES:=gecoosac-files
+  DEPENDS:=@(aarch64||arm||i386||mips||mipsel||x86_64) +openssl-util +coreutils-timeout
+  PROVIDES:=gecoosac-files gecoosac-common
 endef
 
 define Package/$(PKG_NAME)/conffiles
@@ -66,11 +66,13 @@ define Package/$(PKG_NAME)/install
 	$(INSTALL_DIR) $(1)/etc/gecoosac/tls
 	$(INSTALL_DIR) $(1)/etc/init.d
 	$(INSTALL_DIR) $(1)/etc/uci-defaults
+	$(INSTALL_DIR) $(1)/usr/share/gecoosac
 
 	$(INSTALL_BIN) $(PKG_BUILD_DIR)/$(PKG_NAME) $(1)/usr/bin
 	$(INSTALL_BIN) ./files/etc/init.d/gecoosac $(1)/etc/init.d/gecoosac
 	$(INSTALL_BIN) ./files/etc/uci-defaults/gecoosac $(1)/etc/uci-defaults/gecoosac
 	$(INSTALL_CONF) ./files/etc/config/gecoosac $(1)/etc/config/gecoosac
+	$(INSTALL_DATA) ./files/usr/share/gecoosac/common.sh $(1)/usr/share/gecoosac/common.sh
 endef
 
 $(eval $(call BuildPackage,$(PKG_NAME)))

gecoosac/files/etc/init.d/gecoosac

@@ -3,6 +3,7 @@
 
 . /lib/functions.sh
 . /lib/functions/procd.sh
+. /usr/share/gecoosac/common.sh
 
 USE_PROCD=1
 
@@ -10,13 +11,9 @@ START=90
 STOP=10
 
 PROG=/usr/bin/gecoosac
-DEFAULT_DB_DIR=/etc/gecoosac
-DEFAULT_UPLOAD_DIR=/tmp/gecoosac/upload
-DEFAULT_CRT_FILE=/etc/gecoosac/tls/gecoosac.crt
-DEFAULT_KEY_FILE=/etc/gecoosac/tls/gecoosac.key
-DEFAULT_PID_DIR=/var/run
 DEFAULT_LANG=zh
 CERT_TIMEOUT=60
+CERT_RENEW_BEFORE=2592000
 
 init_conf() {
 	local section_type
@@ -47,193 +44,6 @@ init_conf() {
 	config_get "log" "config" "log" "0"
 }
 
-is_abs_path() {
-	case "$1" in
-		/*) return 0 ;;
-		*) return 1 ;;
-	esac
-}
-
-normalize_path() {
-	local path="$1"
-	local part normalized parent
-
-	is_abs_path "$path" || return 1
-	normalized="/"
-	path="${path#/}"
-
-	while [ -n "$path" ]; do
-		part="${path%%/*}"
-		if [ "$part" = "$path" ]; then
-			path=""
-		else
-			path="${path#*/}"
-		fi
-
-		case "$part" in
-			""|.) ;;
-			..)
-				if [ "$normalized" != "/" ]; then
-					parent="${normalized%/*}"
-					[ -n "$parent" ] || parent="/"
-					normalized="$parent"
-				fi
-			;;
-			*) normalized="${normalized%/}/$part" ;;
-		esac
-	done
-
-	printf '%s\n' "$normalized"
-}
-
-path_has_clear_stage_component() {
-	local path="$1" part rest
-
-	path="$(normalize_path "$path")" || return 1
-	rest="${path#/}"
-	while [ -n "$rest" ]; do
-		part="${rest%%/*}"
-		if [ "$part" = "$rest" ]; then
-			rest=""
-		else
-			rest="${rest#*/}"
-		fi
-		case "$part" in
-			.gecoosac-clear.*) return 0 ;;
-		esac
-	done
-
-	return 1
-}
-
-path_uses_clear_stage() {
-	local path="$1" resolved
-
-	path_has_clear_stage_component "$path" && return 0
-	if [ -e "$path" ] || [ -L "$path" ]; then
-		resolved="$(readlink -f "$path" 2>/dev/null)" || return 1
-		path_has_clear_stage_component "$resolved" && return 0
-	fi
-
-	return 1
-}
-
-is_supported_upload_path() {
-	local path="$1" storage
-
-	path="$(normalize_path "$path")" || return 1
-	path_uses_clear_stage "$path" && return 1
-	[ "$path" = "$DEFAULT_UPLOAD_DIR" ] && return 0
-
-	case "$path" in
-		/mnt/*/gecoosac/upload)
-			storage="${path#/mnt/}"
-			storage="${storage%/gecoosac/upload}"
-			[ -n "$storage" ] && [ "${storage#*/}" = "$storage" ]
-		;;
-		*) return 1 ;;
-	esac
-}
-
-is_safe_upload_dir() {
-	local path physical
-
-	path="$(normalize_path "$1")" || return 1
-	physical="$(managed_dir_path upload "$path")" || return 1
-	is_supported_upload_path "$path" || return 1
-	is_supported_upload_path "$physical"
-}
-
-is_path_in_dir() {
-	local path root
-
-	path="$(normalize_path "$1")" || return 1
-	root="$(normalize_path "$2")" || return 1
-
-	[ "$root" != "/" ] || return 1
-	[ "$path" = "$root" ] && return 0
-	[ "${path#"$root"/}" != "$path" ]
-}
-
-is_secure_dir() {
-	local allow_sticky="$2" owner permissions metadata
-
-	[ -d "$1" ] && [ ! -L "$1" ] || return 1
-	metadata="$(ls -ldn "$1" 2>/dev/null)" || return 1
-	set -- $metadata
-	permissions="$1"
-	owner="$3"
-	[ "$owner" = "0" ] || return 1
-	case "$permissions" in
-		d?????????) ;;
-		*) return 1 ;;
-	esac
-
-	if [ "$(printf '%s' "$permissions" | cut -c6)" = "w" ] || \
-		[ "$(printf '%s' "$permissions" | cut -c9)" = "w" ]; then
-		[ "$allow_sticky" = "1" ] && [ "$(printf '%s' "$permissions" | cut -c10)" = "t" ] || return 1
-	fi
-}
-
-is_secure_upload_dir() {
-	local path current part rest
-
-	path="$(normalize_path "$1")" || return 1
-	[ -d "$path" ] && [ ! -L "$path" ] || return 1
-	current="/"
-	rest="${path#/}"
-
-	while [ -n "$rest" ]; do
-		part="${rest%%/*}"
-		if [ "$part" = "$rest" ]; then
-			rest=""
-		else
-			rest="${rest#*/}"
-		fi
-		current="${current%/}/$part"
-		case "$current" in
-			/tmp) is_secure_dir "$current" 1 || return 1 ;;
-			*) is_secure_dir "$current" || return 1 ;;
-		esac
-	done
-}
-
-is_safe_db_dir() {
-	local path upload_root physical physical_upload_root
-
-	path="$(normalize_path "$1")" || return 1
-	upload_root="$(normalize_path "${2:-$DEFAULT_UPLOAD_DIR}")" || return 1
-
-	case "$path" in
-		/etc/gecoosac|/etc/gecoosac/*|/tmp/gecoosac|/tmp/gecoosac/*|/var/lib/gecoosac|/var/lib/gecoosac/*) ;;
-		*) return 1 ;;
-	esac
-	is_path_in_dir "$path" "$upload_root" && return 1
-	physical="$(managed_dir_path db "$path")" || return 1
-	physical_upload_root="$(managed_dir_path upload "$upload_root")" || return 1
-	is_path_in_dir "$physical" "$physical_upload_root" && return 1
-
-	return 0
-}
-
-is_safe_pid_dir() {
-	local path upload_root physical physical_upload_root
-
-	path="$(normalize_path "$1")" || return 1
-	upload_root="$(normalize_path "${2:-$DEFAULT_UPLOAD_DIR}")" || return 1
-
-	case "$path" in
-		/var/run|/var/run/*|/tmp/gecoosac|/tmp/gecoosac/*) ;;
-		*) return 1 ;;
-	esac
-	is_path_in_dir "$path" "$upload_root" && return 1
-	physical="$(managed_dir_path pid "$path")" || return 1
-	physical_upload_root="$(managed_dir_path upload "$upload_root")" || return 1
-	is_path_in_dir "$physical" "$physical_upload_root" && return 1
-
-	return 0
-}
-
 is_port() {
 	case "$1" in
 		""|*[!0-9]*) return 1 ;;
@@ -242,66 +52,6 @@ is_port() {
 	[ "$1" -ge 1 ] 2>/dev/null && [ "$1" -le 65535 ]
 }
 
-run_with_timeout() {
-	local timeout pid i
-
-	timeout="$1"
-	shift
-
-	"$@" >/dev/null 2>&1 &
-	pid="$!"
-	i=0
-
-	while kill -0 "$pid" >/dev/null 2>&1; do
-		if [ "$i" -ge "$timeout" ]; then
-			kill "$pid" >/dev/null 2>&1
-			sleep 1
-			kill -9 "$pid" >/dev/null 2>&1
-			return 1
-		fi
-		sleep 1
-		i=$((i + 1))
-	done
-
-	wait "$pid"
-}
-
-run_with_timeout_output() {
-	local timeout output pid i
-
-	timeout="$1"
-	output="$2"
-	shift 2
-
-	"$@" >"$output" 2>/dev/null &
-	pid="$!"
-	i=0
-
-	while kill -0 "$pid" >/dev/null 2>&1; do
-		if [ "$i" -ge "$timeout" ]; then
-			kill "$pid" >/dev/null 2>&1
-			kill -9 "$pid" >/dev/null 2>&1
-			return 1
-		fi
-		sleep 1
-		i=$((i + 1))
-	done
-
-	wait "$pid"
-}
-
-is_readable_regular_file() {
-	local path="$1" tmp_dir status
-
-	tmp_dir="$(mktemp -d /tmp/gecoosac-file.XXXXXX)" || return 1
-	run_with_timeout_output "$CERT_TIMEOUT" "$tmp_dir/check" \
-		/bin/sh -c '[ -f "$1" ] && [ -r "$1" ] && [ -s "$1" ]' \
-		gecoosac-file-check "$path" </dev/null
-	status="$?"
-	rm -rf "$tmp_dir"
-	return "$status"
-}
-
 is_ipv4() {
 	local value="$1"
 	local part count
@@ -328,48 +78,55 @@ san_has_entry() {
 	local san="$1"
 	local entry="$2"
 
-	echo "$san" | tr ',' '\n' | sed 's/^[[:space:]]*//;s/[[:space:]]*$//' | grep -F -x -q "$entry"
+	printf '%s\n' "$san" | tr ',' '\n' | sed 's/^[[:space:]]*//;s/[[:space:]]*$//' | grep -F -x -q "$entry"
 }
 
-cert_matches_san() {
-	local cert_file="$1" cert_host="$2" cert_ip="$3"
-	local san tmp_dir
+run_with_timeout_output() {
+	local limit="$1" output="$2"
+	shift 2
 
-	is_readable_regular_file "$cert_file" || return 1
-	tmp_dir="$(mktemp -d /tmp/gecoosac-cert.XXXXXX)" || return 1
-	if ! run_with_timeout_output "$CERT_TIMEOUT" "$tmp_dir/san" \
-		openssl x509 -in "$cert_file" -noout -ext subjectAltName </dev/null; then
-		rm -rf "$tmp_dir"
-		return 1
-	fi
-	san="$(cat "$tmp_dir/san" 2>/dev/null)"
-	rm -rf "$tmp_dir"
-	[ -n "$san" ] || return 1
-	san_has_entry "$san" "DNS:${cert_host}" || return 1
-	[ -z "$cert_ip" ] || san_has_entry "$san" "IP Address:${cert_ip}" || return 1
-
-	return 0
+	# coreutils-timeout waits for completion directly and also bounds commands
+	# which ignore SIGTERM; no polling delay or orphaned sleep process is needed.
+	timeout -k 1 "$limit" "$@" >"$output" 2>/dev/null
 }
 
-cert_matches_key() {
-	local cert_file="$1" key_file="$2"
-	local cert_pub key_pub tmp_dir
+run_with_timeout() {
+	local limit="$1"
+	shift
+	run_with_timeout_output "$limit" /dev/null "$@"
+}
+
+cert_pair_valid() {
+	local cert_file="$1" key_file="$2" cert_host="$3" cert_ip="$4"
+	local min_lifetime="${5:-0}" tmp_dir cert_pub key_pub san status
 
-	is_readable_regular_file "$cert_file" || return 1
-	is_readable_regular_file "$key_file" || return 1
 	tmp_dir="$(mktemp -d /tmp/gecoosac-cert.XXXXXX)" || return 1
-	if ! run_with_timeout_output "$CERT_TIMEOUT" "$tmp_dir/cert.pub" \
-		openssl x509 -in "$cert_file" -noout -pubkey </dev/null || \
-		! run_with_timeout_output "$CERT_TIMEOUT" "$tmp_dir/key.pub" \
-		openssl pkey -in "$key_file" -pubout </dev/null; then
-		rm -rf "$tmp_dir"
-		return 1
+	status=1
+	if run_with_timeout "$CERT_TIMEOUT" /bin/sh -c '
+		[ -f "$1" ] && [ -r "$1" ] && [ -s "$1" ] &&
+		[ -f "$2" ] && [ -r "$2" ] && [ -s "$2" ]
+	' gecoosac-file-check "$cert_file" "$key_file" </dev/null && \
+		run_with_timeout_output "$CERT_TIMEOUT" "$tmp_dir/cert" \
+			openssl x509 -in "$cert_file" -noout -pubkey -ext subjectAltName -checkend "$min_lifetime" </dev/null && \
+		run_with_timeout_output "$CERT_TIMEOUT" "$tmp_dir/key.pub" \
+			openssl pkey -in "$key_file" -pubout </dev/null && \
+		run_with_timeout "$CERT_TIMEOUT" \
+			openssl verify -partial_chain -trusted "$cert_file" "$cert_file" </dev/null; then
+		# Trust the configured leaf only for the local validity-period check;
+		# browser trust still depends on the certificate installed by the user.
+		cert_pub="$(sed -n '/^-----BEGIN PUBLIC KEY-----$/,/^-----END PUBLIC KEY-----$/p' "$tmp_dir/cert")"
+		key_pub="$(cat "$tmp_dir/key.pub")"
+		if [ -n "$cert_pub" ] && [ "$cert_pub" = "$key_pub" ]; then
+			status=0
+			if [ -n "$cert_host" ]; then
+				san="$(cat "$tmp_dir/cert")"
+				san_has_entry "$san" "DNS:${cert_host}" || status=1
+				[ -z "$cert_ip" ] || san_has_entry "$san" "IP Address:${cert_ip}" || status=1
+			fi
+		fi
 	fi
-	cert_pub="$(cat "$tmp_dir/cert.pub" 2>/dev/null)"
-	key_pub="$(cat "$tmp_dir/key.pub" 2>/dev/null)"
 	rm -rf "$tmp_dir"
-
-	[ -n "$cert_pub" ] && [ "$cert_pub" = "$key_pub" ]
+	return "$status"
 }
 
 generate_default_cert() {
@@ -389,7 +146,7 @@ generate_default_cert() {
 	cert_ip="$(uci -q get network.lan.ipaddr)"
 	is_ipv4 "$cert_ip" || cert_ip=""
 
-	if is_readable_regular_file "$DEFAULT_KEY_FILE" && cert_matches_san "$DEFAULT_CRT_FILE" "$cert_host" "$cert_ip" && cert_matches_key "$DEFAULT_CRT_FILE" "$DEFAULT_KEY_FILE"; then
+	if cert_pair_valid "$DEFAULT_CRT_FILE" "$DEFAULT_KEY_FILE" "$cert_host" "$cert_ip" "$CERT_RENEW_BEFORE"; then
 		return 0
 	fi
 
@@ -423,9 +180,7 @@ generate_default_cert() {
 		return 1
 	fi
 
-	if [ ! -s "$tmp_crt" ] || [ ! -s "$tmp_key" ] || \
-		! cert_matches_san "$tmp_crt" "$cert_host" "$cert_ip" || \
-		! cert_matches_key "$tmp_crt" "$tmp_key" || \
+	if ! cert_pair_valid "$tmp_crt" "$tmp_key" "$cert_host" "$cert_ip" "$CERT_RENEW_BEFORE" || \
 		! chmod 600 "$tmp_key" || ! chmod 644 "$tmp_crt"; then
 		rm -f "$tmp_crt" "$tmp_key"
 		logger -t gecoosac "failed to validate default HTTPS certificate"
@@ -468,10 +223,8 @@ generate_default_cert() {
 		old_key=1
 	fi
 
-	if mv "$tmp_key" "$DEFAULT_KEY_FILE" && \
-		mv "$tmp_crt" "$DEFAULT_CRT_FILE" && \
-		cert_matches_san "$DEFAULT_CRT_FILE" "$cert_host" "$cert_ip" && \
-		cert_matches_key "$DEFAULT_CRT_FILE" "$DEFAULT_KEY_FILE"; then
+	# Both temporary files were validated above; rename preserves their contents.
+	if mv "$tmp_key" "$DEFAULT_KEY_FILE" && mv "$tmp_crt" "$DEFAULT_CRT_FILE"; then
 		rm -rf "$backup_dir"
 		return 0
 	fi
@@ -601,31 +354,6 @@ ensure_secure_dir_tree() {
 	done
 }
 
-managed_dir_path() {
-	local role="$1" path anchor
-
-	case "$role" in
-		upload|db|pid|file|tls) ;;
-		*) return 1 ;;
-	esac
-	path="$(normalize_path "$2")" || return 1
-	case "$path" in
-		/var/run|/var/run/*)
-			anchor="$(readlink -f /var/run 2>/dev/null)" || return 1
-			[ "$anchor" = "/tmp/run" ] || return 1
-			printf '%s%s\n' "$anchor" "${path#/var/run}"
-		;;
-		/var|/var/*)
-			anchor="$(readlink -f /var 2>/dev/null)" || return 1
-			case "$anchor" in
-				/var|/tmp) printf '%s%s\n' "$anchor" "${path#/var}" ;;
-				*) return 1 ;;
-			esac
-		;;
-		*) printf '%s\n' "$path" ;;
-	esac
-}
-
 ensure_upload_storage_root() {
 	local path="$1" root
 
@@ -677,10 +405,8 @@ prepare_service() {
 	if [ "$isonlyoneprot" = "0" ] && [ "$https" = "1" ]; then
 		if [ "$crt_file" = "$DEFAULT_CRT_FILE" ] && [ "$key_file" = "$DEFAULT_KEY_FILE" ]; then
 			generate_default_cert || return 1
-		fi
-
-		if ! cert_matches_key "$crt_file" "$key_file"; then
-			logger -t gecoosac "HTTPS certificate and key do not match or cannot be read"
+		elif ! cert_pair_valid "$crt_file" "$key_file"; then
+			logger -t gecoosac "HTTPS certificate is not currently valid, or its private key cannot be read or does not match"
 			return 1
 		fi
 	fi

gecoosac/files/etc/uci-defaults/gecoosac

@@ -1,12 +1,9 @@
 #!/bin/sh
 
+. /usr/share/gecoosac/common.sh
+
 changed=0
-DEFAULT_DB_DIR=/etc/gecoosac
-DEFAULT_UPLOAD_DIR=/tmp/gecoosac/upload
 LEGACY_UPLOAD_DIR=/etc/gecoosac/upload
-DEFAULT_CRT_FILE=/etc/gecoosac/tls/gecoosac.crt
-DEFAULT_KEY_FILE=/etc/gecoosac/tls/gecoosac.key
-DEFAULT_PID_DIR=/var/run
 OLD_CRT_FILE=/etc/gecoosac/tls/1.crt
 OLD_KEY_FILE=/etc/gecoosac/tls/1.key
 CONFIG_COMPAT=2
@@ -26,192 +23,6 @@ set_default() {
 	changed=1
 }
 
-normalize_path() {
-	local path="$1"
-	local part normalized parent
-
-	is_abs_path "$path" || return 1
-	normalized="/"
-	path="${path#/}"
-
-	while [ -n "$path" ]; do
-		part="${path%%/*}"
-		if [ "$part" = "$path" ]; then
-			path=""
-		else
-			path="${path#*/}"
-		fi
-
-		case "$part" in
-			""|.) ;;
-			..)
-				if [ "$normalized" != "/" ]; then
-					parent="${normalized%/*}"
-					[ -n "$parent" ] || parent="/"
-					normalized="$parent"
-				fi
-			;;
-			*) normalized="${normalized%/}/$part" ;;
-		esac
-	done
-
-	printf '%s\n' "$normalized"
-}
-
-is_abs_path() {
-	case "$1" in
-		/*) return 0 ;;
-		*) return 1 ;;
-	esac
-}
-
-managed_dir_path() {
-	local role="$1" path anchor
-
-	case "$role" in
-		upload|db|pid|file) ;;
-		*) return 1 ;;
-	esac
-	path="$(normalize_path "$2")" || return 1
-	case "$path" in
-		/var/run|/var/run/*)
-			anchor="$(readlink -f /var/run 2>/dev/null)" || return 1
-			[ "$anchor" = "/tmp/run" ] || return 1
-			printf '%s%s\n' "$anchor" "${path#/var/run}"
-		;;
-		/var|/var/*)
-			anchor="$(readlink -f /var 2>/dev/null)" || return 1
-			case "$anchor" in
-				/var|/tmp) printf '%s%s\n' "$anchor" "${path#/var}" ;;
-				*) return 1 ;;
-			esac
-		;;
-		*) printf '%s\n' "$path" ;;
-	esac
-}
-
-path_has_clear_stage_component() {
-	local path="$1" part rest
-
-	path="$(normalize_path "$path")" || return 1
-	rest="${path#/}"
-	while [ -n "$rest" ]; do
-		part="${rest%%/*}"
-		if [ "$part" = "$rest" ]; then
-			rest=""
-		else
-			rest="${rest#*/}"
-		fi
-		case "$part" in
-			.gecoosac-clear.*) return 0 ;;
-		esac
-	done
-
-	return 1
-}
-
-path_uses_clear_stage() {
-	local path="$1" resolved
-
-	path_has_clear_stage_component "$path" && return 0
-	if [ -e "$path" ] || [ -L "$path" ]; then
-		resolved="$(readlink -f "$path" 2>/dev/null)" || return 1
-		path_has_clear_stage_component "$resolved" && return 0
-	fi
-
-	return 1
-}
-
-is_supported_upload_path() {
-	local path="$1" storage
-
-	path="$(normalize_path "$path")" || return 1
-	path_uses_clear_stage "$path" && return 1
-	[ "$path" = "$DEFAULT_UPLOAD_DIR" ] && return 0
-
-	case "$path" in
-		/mnt/*/gecoosac/upload)
-			storage="${path#/mnt/}"
-			storage="${storage%/gecoosac/upload}"
-			[ -n "$storage" ] && [ "${storage#*/}" = "$storage" ]
-		;;
-		*) return 1 ;;
-	esac
-}
-
-is_safe_upload_dir() {
-	local path physical
-
-	path="$(normalize_path "$1")" || return 1
-	physical="$(managed_dir_path upload "$path")" || return 1
-	is_supported_upload_path "$path" || return 1
-	is_supported_upload_path "$physical"
-}
-
-is_path_in_dir() {
-	local path root
-
-	path="$(normalize_path "$1")" || return 1
-	root="$(normalize_path "$2")" || return 1
-
-	[ "$root" != "/" ] || return 1
-	[ "$path" = "$root" ] && return 0
-	[ "${path#"$root"/}" != "$path" ]
-}
-
-path_has_mount() {
-	local root line mount_path
-
-	root="$(normalize_path "$1")" || return 2
-	[ -r /proc/self/mountinfo ] || return 2
-
-	while IFS= read -r line; do
-		mount_path="$(printf '%s\n' "$line" | cut -d ' ' -f 5)" || return 2
-		[ -n "$mount_path" ] || return 2
-		mount_path="$(printf '%b\n' "$mount_path" 2>/dev/null)" || return 2
-		mount_path="$(normalize_path "$mount_path")" || return 2
-		is_path_in_dir "$mount_path" "$root" && return 0
-	done < /proc/self/mountinfo
-
-	return 1
-}
-
-is_safe_db_dir() {
-	local path upload_root physical physical_upload_root
-
-	path="$(normalize_path "$1")" || return 1
-	upload_root="$(normalize_path "${2:-$DEFAULT_UPLOAD_DIR}")" || return 1
-
-	case "$path" in
-		/etc/gecoosac|/etc/gecoosac/*|/tmp/gecoosac|/tmp/gecoosac/*|/var/lib/gecoosac|/var/lib/gecoosac/*) ;;
-		*) return 1 ;;
-	esac
-	is_path_in_dir "$path" "$upload_root" && return 1
-	physical="$(managed_dir_path db "$path")" || return 1
-	physical_upload_root="$(managed_dir_path upload "$upload_root")" || return 1
-	is_path_in_dir "$physical" "$physical_upload_root" && return 1
-
-	return 0
-}
-
-is_safe_pid_dir() {
-	local path upload_root physical physical_upload_root
-
-	path="$(normalize_path "$1")" || return 1
-	upload_root="$(normalize_path "${2:-$DEFAULT_UPLOAD_DIR}")" || return 1
-
-	case "$path" in
-		/var/run|/var/run/*|/tmp/gecoosac|/tmp/gecoosac/*) ;;
-		*) return 1 ;;
-	esac
-	is_path_in_dir "$path" "$upload_root" && return 1
-	physical="$(managed_dir_path pid "$path")" || return 1
-	physical_upload_root="$(managed_dir_path upload "$upload_root")" || return 1
-	is_path_in_dir "$physical" "$physical_upload_root" && return 1
-
-	return 0
-}
-
 normalize_upload_dir() {
 	local upload_dir normalized
 
@@ -229,38 +40,45 @@ normalize_upload_dir() {
 }
 
 configured_path_in_legacy_upload() {
-	local option path resolved
+	local physical="$1" option role path
 
 	for option in db_dir piddir crt_file key_file; do
 		path="$(uci -q get "gecoosac.config.${option}")"
 		[ -n "$path" ] || continue
-		path="$(normalize_path "$path")" || return 0
-		is_path_in_dir "$path" "$LEGACY_UPLOAD_DIR" && return 0
-
-		if [ -e "$path" ] || [ -L "$path" ]; then
-			resolved="$(readlink -f "$path" 2>/dev/null)" || return 0
-			resolved="$(normalize_path "$resolved")" || return 0
-			is_path_in_dir "$resolved" "$LEGACY_UPLOAD_DIR" && return 0
-		fi
+		case "$option" in
+			db_dir) role=db ;;
+			piddir) role=pid ;;
+			*) role="file" ;;
+		esac
+		protected_path_in_dir "$path" "$role" "$physical" "$LEGACY_UPLOAD_DIR" "$physical"
+		case "$?" in
+			1) ;;
+			*) return 0 ;;
+		esac
 	done
 
 	return 1
 }
 
 cleanup_legacy_upload_dir() {
-	local mount_state
+	local physical mount_state
 
 	[ -e "$LEGACY_UPLOAD_DIR" ] || [ -L "$LEGACY_UPLOAD_DIR" ] || return 0
 	if [ ! -d "$LEGACY_UPLOAD_DIR" ] || [ -L "$LEGACY_UPLOAD_DIR" ]; then
 		logger -t gecoosac "refusing to remove unsafe legacy upload path: $LEGACY_UPLOAD_DIR"
 		return 0
 	fi
-	if configured_path_in_legacy_upload; then
+	physical="$(readlink -f "$LEGACY_UPLOAD_DIR" 2>/dev/null)" || {
+		logger -t gecoosac "unable to resolve legacy upload path: $LEGACY_UPLOAD_DIR"
+		return 0
+	}
+	physical="$(normalize_path "$physical")" || return 0
+	if configured_path_in_legacy_upload "$physical"; then
 		logger -t gecoosac "preserving legacy upload path referenced by configuration: $LEGACY_UPLOAD_DIR"
 		return 0
 	fi
 
-	path_has_mount "$LEGACY_UPLOAD_DIR"
+	path_has_mount "$physical"
 	mount_state="$?"
 	case "$mount_state" in
 		0)
@@ -273,7 +91,13 @@ cleanup_legacy_upload_dir() {
 		;;
 	esac
 
-	rm -rf "$LEGACY_UPLOAD_DIR" || {
+	# Apply the same ownership and ancestor-symlink policy as RPC cleanup.
+	# Relocated legacy directories are preserved for manual review.
+	if ! is_secure_upload_dir "$LEGACY_UPLOAD_DIR" || [ "$physical" != "$LEGACY_UPLOAD_DIR" ]; then
+		logger -t gecoosac "refusing to remove unsafe legacy upload path: $LEGACY_UPLOAD_DIR"
+		return 0
+	fi
+	rm -rf "$physical" || {
 		logger -t gecoosac "failed to remove legacy upload path: $LEGACY_UPLOAD_DIR"
 		return 1
 	}
@@ -310,7 +134,7 @@ is_managed_cert_path() {
 
 is_regular_file_or_absent() {
 	[ ! -e "$1" ] && [ ! -L "$1" ] && return 0
-	[ -f "$1" ] && [ ! -L "$1" ]
+	[ -f "$1" ] && [ ! -L "$1" ] && is_secure_upload_dir "${1%/*}"
 }
 
 migrate_default_certificates() {

gecoosac/files/usr/share/gecoosac/common.sh

@@ -0,0 +1,282 @@
+# Shared path policy for the service, configuration migration and LuCI RPC.
+
+DEFAULT_DB_DIR=/etc/gecoosac
+DEFAULT_UPLOAD_DIR=/tmp/gecoosac/upload
+DEFAULT_CRT_FILE=/etc/gecoosac/tls/gecoosac.crt
+DEFAULT_KEY_FILE=/etc/gecoosac/tls/gecoosac.key
+DEFAULT_PID_DIR=/var/run
+
+is_abs_path() {
+	case "$1" in
+		/*) return 0 ;;
+		*) return 1 ;;
+	esac
+}
+
+normalize_path() {
+	local path="$1"
+	local part normalized parent
+
+	is_abs_path "$path" || return 1
+	normalized="/"
+	path="${path#/}"
+
+	while [ -n "$path" ]; do
+		part="${path%%/*}"
+		if [ "$part" = "$path" ]; then
+			path=""
+		else
+			path="${path#*/}"
+		fi
+
+		case "$part" in
+			""|.) ;;
+			..)
+				if [ "$normalized" != "/" ]; then
+					parent="${normalized%/*}"
+					[ -n "$parent" ] || parent="/"
+					normalized="$parent"
+				fi
+			;;
+			*) normalized="${normalized%/}/$part" ;;
+		esac
+	done
+
+	printf '%s\n' "$normalized"
+}
+
+managed_dir_path() {
+	local role="$1" path anchor
+
+	case "$role" in
+		upload|db|pid|file|tls) ;;
+		*) return 1 ;;
+	esac
+	path="$(normalize_path "$2")" || return 1
+	case "$path" in
+		/var/run|/var/run/*)
+			anchor="$(readlink -f /var/run 2>/dev/null)" || return 1
+			[ "$anchor" = "/tmp/run" ] || return 1
+			printf '%s%s\n' "$anchor" "${path#/var/run}"
+		;;
+		/var|/var/*)
+			anchor="$(readlink -f /var 2>/dev/null)" || return 1
+			case "$anchor" in
+				/var|/tmp) printf '%s%s\n' "$anchor" "${path#/var}" ;;
+				*) return 1 ;;
+			esac
+		;;
+		*) printf '%s\n' "$path" ;;
+	esac
+}
+
+path_has_clear_stage_component() {
+	local path="$1" part rest
+
+	path="$(normalize_path "$path")" || return 1
+	rest="${path#/}"
+	while [ -n "$rest" ]; do
+		part="${rest%%/*}"
+		if [ "$part" = "$rest" ]; then
+			rest=""
+		else
+			rest="${rest#*/}"
+		fi
+		case "$part" in
+			.gecoosac-clear.*) return 0 ;;
+		esac
+	done
+
+	return 1
+}
+
+path_uses_clear_stage() {
+	local path="$1" resolved
+
+	path_has_clear_stage_component "$path" && return 0
+	if [ -e "$path" ] || [ -L "$path" ]; then
+		resolved="$(readlink -f "$path" 2>/dev/null)" || return 1
+		path_has_clear_stage_component "$resolved" && return 0
+	fi
+
+	return 1
+}
+
+is_supported_upload_path() {
+	local path="$1" storage
+
+	path="$(normalize_path "$path")" || return 1
+	path_uses_clear_stage "$path" && return 1
+	[ "$path" = "$DEFAULT_UPLOAD_DIR" ] && return 0
+
+	case "$path" in
+		/mnt/*/gecoosac/upload)
+			storage="${path#/mnt/}"
+			storage="${storage%/gecoosac/upload}"
+			[ -n "$storage" ] && [ "${storage#*/}" = "$storage" ]
+		;;
+		*) return 1 ;;
+	esac
+}
+
+is_safe_upload_dir() {
+	local path physical
+
+	path="$(normalize_path "$1")" || return 1
+	physical="$(managed_dir_path upload "$path")" || return 1
+	is_supported_upload_path "$path" || return 1
+	is_supported_upload_path "$physical"
+}
+
+is_path_in_dir() {
+	local path root
+
+	path="$(normalize_path "$1")" || return 1
+	root="$(normalize_path "$2")" || return 1
+
+	[ "$root" != "/" ] || return 1
+	[ "$path" = "$root" ] && return 0
+	[ "${path#"$root"/}" != "$path" ]
+}
+
+is_secure_dir() {
+	local allow_sticky="$2" owner permissions metadata
+
+	[ -d "$1" ] && [ ! -L "$1" ] || return 1
+	metadata="$(ls -ldn "$1" 2>/dev/null)" || return 1
+	set -- $metadata
+	permissions="$1"
+	owner="$3"
+	[ "$owner" = "0" ] || return 1
+	case "$permissions" in
+		d?????????) ;;
+		*) return 1 ;;
+	esac
+
+	if [ "$(printf '%s' "$permissions" | cut -c6)" = "w" ] || \
+		[ "$(printf '%s' "$permissions" | cut -c9)" = "w" ]; then
+		[ "$allow_sticky" = "1" ] && [ "$(printf '%s' "$permissions" | cut -c10)" = "t" ] || return 1
+	fi
+}
+
+is_secure_upload_dir() {
+	local path current part rest
+
+	path="$(normalize_path "$1")" || return 1
+	[ -d "$path" ] && [ ! -L "$path" ] || return 1
+	current="/"
+	rest="${path#/}"
+
+	while [ -n "$rest" ]; do
+		part="${rest%%/*}"
+		if [ "$part" = "$rest" ]; then
+			rest=""
+		else
+			rest="${rest#*/}"
+		fi
+		current="${current%/}/$part"
+		case "$current" in
+			/tmp) is_secure_dir "$current" 1 || return 1 ;;
+			*) is_secure_dir "$current" || return 1 ;;
+		esac
+	done
+}
+
+is_safe_db_dir() {
+	local path upload_root physical physical_upload_root
+
+	path="$(normalize_path "$1")" || return 1
+	upload_root="$(normalize_path "${2:-$DEFAULT_UPLOAD_DIR}")" || return 1
+
+	case "$path" in
+		/etc/gecoosac|/etc/gecoosac/*|/tmp/gecoosac|/tmp/gecoosac/*|/var/lib/gecoosac|/var/lib/gecoosac/*) ;;
+		*) return 1 ;;
+	esac
+	is_path_in_dir "$path" "$upload_root" && return 1
+	physical="$(managed_dir_path db "$path")" || return 1
+	physical_upload_root="$(managed_dir_path upload "$upload_root")" || return 1
+	is_path_in_dir "$physical" "$physical_upload_root" && return 1
+
+	return 0
+}
+
+is_safe_pid_dir() {
+	local path upload_root physical physical_upload_root
+
+	path="$(normalize_path "$1")" || return 1
+	upload_root="$(normalize_path "${2:-$DEFAULT_UPLOAD_DIR}")" || return 1
+
+	case "$path" in
+		/var/run|/var/run/*|/tmp/gecoosac|/tmp/gecoosac/*) ;;
+		*) return 1 ;;
+	esac
+	is_path_in_dir "$path" "$upload_root" && return 1
+	physical="$(managed_dir_path pid "$path")" || return 1
+	physical_upload_root="$(managed_dir_path upload "$upload_root")" || return 1
+	is_path_in_dir "$physical" "$physical_upload_root" && return 1
+
+	return 0
+}
+
+path_has_mount() {
+	local root mount_id parent_id device mount_root mount_path rest
+
+	root="$(normalize_path "$1")" || return 2
+	[ -r /proc/self/mountinfo ] || return 2
+
+	while IFS=' ' read -r mount_id parent_id device mount_root mount_path rest; do
+		[ -n "$mount_path" ] && [ -n "$rest" ] || return 2
+		mount_path="$(printf '%b\n' "$mount_path" 2>/dev/null)" || return 2
+		mount_path="$(normalize_path "$mount_path")" || return 2
+		is_path_in_dir "$mount_path" "$root" && return 0
+	done < /proc/self/mountinfo
+
+	return 1
+}
+
+# The checked root must be a resolved, validated directory. Return 0 for a
+# protected path, 1 for an unrelated path, or 2 when validation is impossible.
+# Keep the original spelling when resolving symlinks: link/../file and its
+# lexical normalization can refer to different files.
+protected_path_in_dir() {
+	local raw_path="$1" role="$2" checked_root="$3"
+	local live_logical="${4:-$3}" live_physical="${5:-$3}"
+	local path="$1" physical real_path suffix mapped
+
+	[ -n "$path" ] || return 1
+
+	path="$(normalize_path "$path")" || return 2
+	physical="$(managed_dir_path "$role" "$path")" || return 2
+	checked_root="$(normalize_path "$checked_root")" || return 2
+	live_logical="$(normalize_path "$live_logical")" || return 2
+	live_physical="$(normalize_path "$live_physical")" || return 2
+
+	is_path_in_dir "$path" "$checked_root" && return 0
+	is_path_in_dir "$physical" "$checked_root" && return 0
+	real_path="$(readlink -f "$raw_path" 2>/dev/null)" || return 2
+	[ -n "$real_path" ] || return 2
+	real_path="$(normalize_path "$real_path")" || return 2
+	is_path_in_dir "$real_path" "$checked_root" && return 0
+
+	[ "$checked_root" != "$live_physical" ] || {
+		is_path_in_dir "$path" "$live_logical" && return 0
+		is_path_in_dir "$physical" "$live_physical" && return 0
+		if [ -n "$real_path" ] && is_path_in_dir "$real_path" "$live_physical"; then
+			return 0
+		fi
+		return 1
+	}
+
+	suffix=
+	if is_path_in_dir "$path" "$live_logical"; then
+		suffix="${path#"$live_logical"}"
+	elif is_path_in_dir "$physical" "$live_physical"; then
+		suffix="${physical#"$live_physical"}"
+	elif [ -n "$real_path" ] && is_path_in_dir "$real_path" "$live_physical"; then
+		suffix="${real_path#"$live_physical"}"
+	else
+		return 1
+	fi
+	mapped="${checked_root%/}${suffix}"
+	[ -e "$mapped" ] || [ -L "$mapped" ]
+}

glorytun/Makefile

@@ -9,7 +9,7 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=glorytun
-PKG_RELEASE:=3
+PKG_RELEASE:=4
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_VERSION:=95fa5ead2154adb546bcdb454c56c876e9f60bb5
 PKG_SOURCE:=glorytun-$(PKG_VERSION).tar.gz
@@ -50,13 +50,10 @@ endef
 define Package/$(PKG_NAME)/install
 	$(INSTALL_DIR) $(1)/usr/sbin
 	$(INSTALL_BIN) $(PKG_BUILD_DIR)/glorytun $(1)/usr/sbin/$(PKG_NAME)
-	$(INSTALL_BIN) files/glorytun-irq-affinity.sh $(1)/usr/sbin/glorytun-irq-affinity.sh
 	$(INSTALL_DIR) $(1)/etc/init.d
 	$(INSTALL_BIN) init $(1)/etc/init.d/$(PKG_NAME)
 	$(INSTALL_DIR) $(1)/etc/config
 	$(INSTALL_DATA) glorytun.config $(1)/etc/config/glorytun
-	$(INSTALL_DIR) $(1)/etc/glorytun
-	$(INSTALL_DATA) files/glorytun-sysctl.conf $(1)/etc/glorytun/glorytun-sysctl.conf
 endef
 
 $(eval $(call BuildPackage,$(PKG_NAME)))

glorytun/files/glorytun-irq-affinity.sh

@@ -1,86 +0,0 @@
-#!/bin/sh
-
-# Set IRQ affinity for glorytun interfaces
-set_irq_affinity() {
-    local irq=$1
-    local cpu=$2
-    local mask=$(printf "%x" $((1 << $cpu)))
-    
-    echo "Setting IRQ $irq to CPU $cpu (mask: $mask)"
-    echo $mask > /proc/irq/$irq/smp_affinity
-}
-
-# Get interface IRQs
-get_interface_irqs() {
-    local interface=$1
-    grep -E "$interface" /proc/interrupts | awk '{print $1}' | tr -d ':'
-}
-
-# Main function
-setup_irq_affinity() {
-    # Get available CPU cores
-    local cpu_count=$(grep -c processor /proc/cpuinfo)
-    echo "Available CPU cores: $cpu_count"
-    
-    # Determine tun interface
-    local tun_interface=$(ip link | grep tun | awk -F': ' '{print $2}' | head -n1)
-    if [ -z "$tun_interface" ]; then
-        echo "No tun interface found"
-        return 1
-    fi
-    
-    echo "Found tun interface: $tun_interface"
-    
-    # Get IRQs for tun interface
-    local irqs=$(get_interface_irqs $tun_interface)
-    if [ -z "$irqs" ]; then
-        echo "No IRQs found for $tun_interface"
-        return 1
-    fi
-    
-    # Distribute IRQs across available cores (except CPU0)
-    local cpu=1
-    for irq in $irqs; do
-        set_irq_affinity $irq $cpu
-        cpu=$(( (cpu + 1) % cpu_count ))
-        if [ $cpu -eq 0 ]; then
-            cpu=1
-        fi
-    done
-    
-    # Set RPS (Receive Packet Steering) for better packet distribution
-    if [ -e /sys/class/net/$tun_interface/queues/rx-0/rps_cpus ]; then
-        # Calculate mask for all CPUs except CPU0
-        local rps_mask=$(printf "%x" $(( (1 << $cpu_count) - 2 )))
-        echo "Setting RPS mask to $rps_mask for $tun_interface"
-        echo $rps_mask > /sys/class/net/$tun_interface/queues/rx-0/rps_cpus
-    fi
-    
-    # Set RFS (Receive Flow Steering) limits if available
-    if [ -e /proc/sys/net/core/rps_sock_flow_entries ]; then
-        echo 32768 > /proc/sys/net/core/rps_sock_flow_entries
-        if [ -e /sys/class/net/$tun_interface/queues/rx-0/rps_flow_cnt ]; then
-            echo 32768 > /sys/class/net/$tun_interface/queues/rx-0/rps_flow_cnt
-        fi
-    fi
-    
-    # Set XPS (Transmit Packet Steering) if available
-    if [ -e /sys/class/net/$tun_interface/queues/tx-0/xps_cpus ]; then
-        # Use all CPUs except CPU0 for transmit
-        local xps_mask=$(printf "%x" $(( (1 << $cpu_count) - 2 )))
-        echo "Setting XPS mask to $xps_mask for $tun_interface"
-        echo $xps_mask > /sys/class/net/$tun_interface/queues/tx-0/xps_cpus
-    fi
-    
-    # Increase network queue length for better performance
-    if [ -e /sys/class/net/$tun_interface/tx_queue_len ]; then
-        echo 1000 > /sys/class/net/$tun_interface/tx_queue_len
-    fi
-    
-    echo "IRQ affinity setup completed for $tun_interface"
-}
-
-# Run the main function
-setup_irq_affinity
-
-exit 0 

glorytun/files/glorytun-sysctl.conf

@@ -1,27 +0,0 @@
-# Glorytun-specific optimizations
-# Note: These settings complement the system-wide sysctl parameters
-
-# Buffer size optimization for glorytun tunnels
-# Increase only if not already set in system configuration
-net.core.rmem_max = 16777216
-net.core.wmem_max = 16777216
-net.core.optmem_max = 16777216
-
-# Enable BBR congestion control for better tunnel performance
-net.core.default_qdisc = fq
-
-# RPS/RFS settings for tunnel interfaces
-# These are critical for multicore performance with glorytun
-net.core.rps_sock_flow_entries = 32768
-
-# Network device tuning for tunnel interfaces
-net.core.netdev_max_backlog = 10000
-net.core.netdev_budget = 600
-net.core.netdev_budget_usecs = 10000
-
-# Lower TCP timeout for faster recovery of tunnel connections
-net.ipv4.tcp_keepalive_intvl = 10
-net.ipv4.tcp_keepalive_probes = 6
-
-# Disable slow start after idle for more consistent tunnel performance
-net.ipv4.tcp_slow_start_after_idle = 0 

glorytun/glorytun.config

@@ -11,6 +11,5 @@ config glorytun 'vpn'
 	option localip '10.255.255.2'
 	option remoteip '10.255.255.1'
 	option multiqueue '1'
-	option cpu_affinity '1'
 	option label 'Default VPN'
 	option timeout '10000'

glorytun/init

@@ -18,14 +18,6 @@ _err() {
 	logger -p daemon.err -t ${PROG_NAME} "$@"
 }
 
-# Apply system optimizations
-apply_sysctl_optimizations() {
-	if [ -f /etc/glorytun/glorytun-sysctl.conf ]; then
-		_log "Applying system optimizations"
-		sysctl -q -p /etc/glorytun/glorytun-sysctl.conf
-	fi
-}
-
 validate_section() {
 	uci_validate_section glorytun glorytun "${1}" \
 		'enable:bool:0'      \
@@ -38,50 +30,13 @@ validate_section() {
 		'timeout:uinteger:10000'         \
 		'chacha20:bool:0'    \
 		'multiqueue:bool:1'  \
-		'cpu_affinity:bool:1' \
 		'proto:string' \
 		'localip:string' \
 		'remoteip:string'
 }
 
-# New function for CPU core optimization
-optimize_cpu_cores() {
-	local dev="$1"
-	local multiqueue="$2"
-	local cpu_affinity="$3"
-	
-	if [ "$cpu_affinity" = "1" ]; then
-		_log "Setting up CPU affinity for $dev"
-		if [ -x /usr/sbin/glorytun-irq-affinity.sh ]; then
-			/usr/sbin/glorytun-irq-affinity.sh
-		fi
-	fi
-	
-	if [ "$multiqueue" = "1" ]; then
-		_log "Enabling multiqueue for $dev"
-		
-		# Get CPU count
-		local cpu_count=$(grep -c processor /proc/cpuinfo)
-		if [ "$cpu_count" -gt 1 ]; then
-			# Use half of available CPUs but at least 2
-			local queue_count=$(( cpu_count / 2 ))
-			[ "$queue_count" -lt 2 ] && queue_count=2
-			
-			# Set multiqueue parameters
-			ip link set dev "$dev" multiqueue on
-			
-			# Increase buffer sizes for better performance
-			if [ -e /proc/sys/net/core/rmem_max ]; then
-				echo 16777216 > /proc/sys/net/core/rmem_max
-				echo 16777216 > /proc/sys/net/core/wmem_max
-				echo 16777216 > /proc/sys/net/core/optmem_max
-			fi
-		fi
-	fi
-}
-
 start_instance() {
-	local enable key host port dev mptcp proto chacha20 mode multiqueue cpu_affinity timeout localip remoteip
+	local enable key host port dev mptcp proto chacha20 mode multiqueue timeout localip remoteip
 	local key_dir="/var/run/${PROG_NAME}"
 	local key_file="${key_dir}/${1}.key"
 
@@ -91,9 +46,6 @@ start_instance() {
 	}
 
 	[ "${enable}" = "1" ] || return 1
-
-	apply_sysctl_optimizations
-
 	[ "${proto}" = "tcp" ] || return 1
 	[ -n "${key}" ] || {
 		_err "Key empty"
@@ -147,25 +99,23 @@ start_instance() {
 	procd_set_param stderr 1
 
 	procd_close_instance
-	
-	# Apply CPU optimizations after the instance is started
-	optimize_cpu_cores "$dev" "$multiqueue" "$cpu_affinity"
-	
-	# Configure interface IP addresses
+
+	# Configure the tunnel addresses once glorytun has created the device.
+	# RPS/XPS steering for it is set by /etc/hotplug.d/net/20-rps-xps
+	# (openmptcprouter package), which handles every interface.
 	if [ -n "$localip" ] && [ -n "$remoteip" ]; then
-                (
-                        # Wait for device to be created
-                        local count=0
-                        while [ $count -lt 10 ]; do
-                                if ip link show "$dev" >/dev/null 2>&1; then
-                                        ifconfig "$dev" "$localip" pointopoint "$remoteip" up && \
-                                        _log "Configured $dev with IP $localip peer $remoteip"
-                                        break
-                                fi
-                                sleep 1
-                                count=$((count + 1))
-                        done
-                ) &
+	(
+		count=0
+		while [ $count -lt 10 ]; do
+			if [ -d "/sys/class/net/$dev" ]; then
+				ifconfig "$dev" "$localip" pointopoint "$remoteip" up && \
+					_log "Configured $dev with IP $localip peer $remoteip"
+				break
+			fi
+			sleep 1
+			count=$((count + 1))
+		done
+	) &
 	fi
 }
 

istoreenhance/Makefile

@@ -11,8 +11,8 @@ PKG_ARCH_ISTOREENHANCE:=$(ARCH)
 
 PKG_NAME:=istoreenhance
 # use PKG_SOURCE_DATE instead of PKG_VERSION for compitable
-PKG_SOURCE_DATE:=0.7.17
-PKG_RELEASE:=7
+PKG_SOURCE_DATE:=0.8.0
+PKG_RELEASE:=8
 ARCH_HEXCODE:=
 ifeq ($(ARCH),x86_64)
 ARCH_HEXCODE=8664

kaiplus/Makefile

@@ -9,8 +9,8 @@ include $(TOPDIR)/rules.mk
 PKG_ARCH_kaiplus:=$(ARCH)
 
 PKG_NAME:=kaiplus
-PKG_VERSION:=linkeasefull-runtime-v3.0.17
-PKG_RELEASE:=9
+PKG_VERSION:=1.0.9
+PKG_RELEASE:=13
 PKG_SOURCE:=$(PKG_NAME)-binary-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://github.com/istoreos/istoreos-app-hub/releases/download/kaiplus-runtime-v$(PKG_VERSION)/
 PKG_HASH:=skip

kaiplus/files/kaiplus-plugin.json

@@ -11,7 +11,8 @@
   },
   "standalone": {
     "entry": "index.html",
-    "basePath": "/apps/kaiplus/"
+    "basePath": "/apps/kaiplus/",
+    "url": "/apps/kaiplus/"
   },
   "config": {
     "providerOrder": ["uci"],

kaiplus/files/kaiplus.config

@@ -8,3 +8,5 @@ config kaiplus
 	option 'bind_addr' '0.0.0.0'
 	option 'base_path' '/apps/kaiplus/'
 	option 'system_role' 'istoreos'
+	option 'release_channel' 'stable'
+	option 'auth_mode' 'disabled'

kaiplus/files/kaiplus.init

@@ -13,6 +13,8 @@ get_config() {
 	config_get bind_addr "$1" bind_addr "0.0.0.0"
 	config_get base_path "$1" base_path "/apps/kaiplus/"
 	config_get system_role "$1" system_role "istoreos"
+	config_get release_channel "$1" release_channel "stable"
+	config_get auth_mode "$1" auth_mode "disabled"
 }
 
 mkdir_p() {
@@ -32,10 +34,12 @@ start_service() {
 	fi
 
 	mkdir_p "$data_dir"
+	umask 077
 	mkdir_p "$data_dir/workspace"
 	mkdir_p "$data_dir/cache"
 	mkdir_p "$data_dir/config"
 	mkdir_p "$data_dir/state"
+	chmod 0700 "$data_dir/config" "$data_dir/state"
 
 	helper_token_file="$data_dir/state/ssh-helper.token"
 	if [ ! -s "$helper_token_file" ]; then
@@ -58,6 +62,9 @@ start_service() {
 		procd_set_param env \
 			KAIPLUS_HOME="$data_dir" \
 			KAIPLUS_SYSTEM_ROLE="$system_role" \
+			KAIPLUS_RELEASE_CHANNEL="$release_channel" \
+			KAIPLUS_AUTH_MODE="$auth_mode" \
+			LINKEASE_AUTH_PROVIDER="$auth_mode" \
 			KAIPLUS_LISTEN_MODE="tcp" \
 			KAIPLUS_WORKSPACE_HELPER_DIR="/usr/share/kaiplus/helpers" \
 			KAIPLUS_WORKSPACE_TOOL_INSTALL_DIR="/tmp/kaiplus_workspace_tool" \
@@ -68,6 +75,9 @@ start_service() {
 		procd_set_param env \
 			KAIPLUS_HOME="$data_dir" \
 			KAIPLUS_SYSTEM_ROLE="$system_role" \
+			KAIPLUS_RELEASE_CHANNEL="$release_channel" \
+			KAIPLUS_AUTH_MODE="$auth_mode" \
+			LINKEASE_AUTH_PROVIDER="$auth_mode" \
 			KAIPLUS_LISTEN_MODE="unix" \
 			KAIPLUS_SOCKET_PATH="$socket_path" \
 			KAIPLUS_WORKSPACE_HELPER_DIR="/usr/share/kaiplus/helpers" \
@@ -88,6 +98,7 @@ start_service() {
 	procd_append_param command --defaults-dir /usr/share/kaiplus/defaults
 	procd_append_param command --base-path "$base_path"
 	procd_append_param command --system-role "$system_role"
+	procd_append_param command --release-channel "$release_channel"
 	procd_set_param stdout 1
 	procd_set_param stderr 1
 	procd_set_param respawn

linkease-common-bin/Makefile

@@ -12,7 +12,7 @@ PKG_ARCH_LINKEASE:=$(ARCH)
 PKG_NAME:=linkease-common-bin
 # use PKG_SOURCE_DATE instead of PKG_VERSION for compitable
 PKG_SOURCE_DATE:=1.7.5
-PKG_RELEASE:=25
+PKG_RELEASE:=32
 
 ARCH_HEXCODE:=
 ifeq ($(ARCH),x86_64)
@@ -28,7 +28,7 @@ else ifeq ($(ARCH),mipsel)
 ARCH_HEXCODE=1b0c
 endif
 
-PKG_SOURCE_VERSION:=7093bc8b705b7b239b8adde8e4d89928157de456
+PKG_SOURCE_VERSION:=4bb94bc5fe4da6d98dfcd730f40fe15f0d71ec4a
 PKG_SOURCE:=linkease-common-bin-$(PKG_SOURCE_DATE)-linux-$(PKG_ARCH_LINKEASE).tar.gz
 PKG_SOURCE_URL:=https://github.com/istoreos/istoreos-app-hub/releases/download/linkease-runtime-v$(PKG_SOURCE_DATE)/
 PKG_BUILD_DIR:=$(BUILD_DIR)/linkease-common-bin-$(PKG_SOURCE_DATE)-linux-$(PKG_ARCH_LINKEASE)

linkease/Makefile

@@ -12,7 +12,7 @@ PKG_ARCH_LINKEASE:=$(ARCH)
 PKG_NAME:=linkease
 # use PKG_SOURCE_DATE instead of PKG_VERSION for compitable
 PKG_SOURCE_DATE:=1.7.5
-PKG_RELEASE:=28
+PKG_RELEASE:=35
 
 ARCH_HEXCODE:=
 ifeq ($(ARCH),x86_64)
@@ -28,7 +28,7 @@ else ifeq ($(ARCH),mipsel)
 ARCH_HEXCODE=1b0c
 endif
 
-PKG_SOURCE_VERSION:=7093bc8b705b7b239b8adde8e4d89928157de456
+PKG_SOURCE_VERSION:=4bb94bc5fe4da6d98dfcd730f40fe15f0d71ec4a
 PKG_SOURCE:=linkease-bin-$(PKG_SOURCE_DATE)-linux-$(PKG_ARCH_LINKEASE).tar.gz
 PKG_SOURCE_URL:=https://github.com/istoreos/istoreos-app-hub/releases/download/linkease-runtime-v$(PKG_SOURCE_DATE)/
 PKG_BUILD_DIR:=$(BUILD_DIR)/linkease-bin-$(PKG_SOURCE_DATE)-linux-$(PKG_ARCH_LINKEASE)

linkeasefull/Makefile

@@ -10,8 +10,8 @@ PKG_ARCH_LINKEASE:=$(ARCH)
 
 PKG_NAME:=linkeasefull
 # use PKG_SOURCE_DATE instead of PKG_VERSION for compitable
-PKG_SOURCE_DATE:=3.0.17
-PKG_RELEASE:=27
+PKG_SOURCE_DATE:=3.0.20
+PKG_RELEASE:=34
 
 ARCH_HEXCODE:=
 ifeq ($(ARCH),x86_64)
@@ -24,7 +24,7 @@ LINKEASE_RUNTIME_ARCH:=arm64
 PKG_HASH:=skip
 endif
 
-PKG_SOURCE_VERSION:=7093bc8b705b7b239b8adde8e4d89928157de456
+PKG_SOURCE_VERSION:=4bb94bc5fe4da6d98dfcd730f40fe15f0d71ec4a
 PKG_SOURCE:=linkease-runtime-$(PKG_SOURCE_DATE)-linux-$(LINKEASE_RUNTIME_ARCH).tar.gz
 PKG_SOURCE_URL:=https://github.com/istoreos/istoreos-app-hub/releases/download/linkeasefull-runtime-v$(PKG_SOURCE_DATE)/
 PKG_BUILD_DIR:=$(BUILD_DIR)/linkease-runtime-$(PKG_SOURCE_DATE)-linux-$(LINKEASE_RUNTIME_ARCH)

luci-app-apfree-wifidog/htdocs/luci-static/resources/view/wifidogx.css

@@ -1,515 +0,0 @@
-#chartjs-tooltip {
-	opacity: 0;
-	position: absolute;
-	background: rgba(0, 0, 0, .7);
-	color: white;
-	padding: 3px;
-	border-radius: 3px;
-	transition: all .1s ease;
-	pointer-events: none;
-	transform: translate(-50%, 0);
-	z-index: 20000;
-}
-
-#chartjs-tooltip.above {
-	transform: translate(-50%, -100%);
-}
-
-#chartjs-tooltip.above:before {
-	border: solid;
-	border-color: #111 transparent;
-	border-color: rgba(0, 0, 0, .8) transparent;
-	border-width: 8px 8px 0 8px;
-	bottom: 1em;
-	content: "";
-	display: block;
-	left: 50%;
-	top: 100%;
-	position: absolute;
-	z-index: 99;
-	transform: translate(-50%, 0);
-}
-
-.pie label {
-	font-weight: bold;
-	font-size: 14px;
-	display: block;
-	margin-bottom: 10px;
-	text-align: center;
-}
-
-.kpi ul {
-	list-style: none;
-}
-
-.kpi li {
-	margin: 10px;
-	display: none;
-}
-
-.kpi big {
-	font-weight: bold;
-}
-
-.head {
-	text-align: center;
-	position: relative;
-	display: flex;
-	flex-wrap: wrap;
-	white-space: normal;
-}
-
-.head .pie {
-	/* min-width: 200px; */
-	padding: 5px;
-	flex: 1 1 30%;
-}
-
-.cbi-tooltip .head .pie {
-	min-width: 100px;
-}
-
-.head .kpi {
-	padding: 5px;
-	font-size: smaller;
-	text-align: left;
-	align-self: center;
-	flex: 1 0 33%;
-	min-width: 150px;
-	display: flex;
-	justify-content: center;
-}
-
-.head .kpi ul {
-	margin: 0;
-}
-
-.td.double > span {
-	display: block;
-}
-
-.cbi-tooltip {
-	box-shadow: 0 0 5px #000;
-}
-
-@media screen and (max-width: 992px) {
-	.td.hide-xs {
-		display: none;
-	}
-
-	.td.double:not(.hide-xs) > span {
-		white-space: nowrap;
-		text-align: left;
-	}
-
-	.td.double:not(.hide-xs) > span:first-child::before {
-		content: "IPv4: ";
-		font-weight: bold;
-	}
-
-	.td.double:not(.hide-xs) > span:last-child::before {
-		content: "IPv6: ";
-		font-weight: bold;
-	}
-}
-
-.form-group {
-	display: flex;
-	align-items: center;    /* 垂直居中 */
-	margin-bottom: 15px;    /* 项间距 */
-	gap: 10px;              /* Label 和 Input 间距 */
-}
-
-/* 标签固定最小宽度 + 右对齐 */
-.form-label {
-	flex: 0 0 120px;       /* 不伸缩、不收缩、基础宽度120px */
-	text-align: right;
-	font-weight: bold;
-	color: #333;
-}
-
-.th-sort-asc::after {
-	content: " ▲";
-}
-
-.th-sort-desc::after {
-	content: " ▼";
-}
-
-.table .th {
-	cursor: pointer;
-}
-
-.table .th:hover {
-	background-color: #f0f0f0;
-}
-
-/* L7 View Specific Styles */
-.l7-view-container #l7-error-message { color: red; background-color: #ffefef; border: 1px solid red; padding: 10px; margin-bottom: 10px; display: none; }
-.l7-view-container .dashboard-container { display: flex; flex-direction: column; gap: 20px; margin-bottom: 20px; }
-.l7-view-container .line-chart-row { display: grid; grid-template-columns: repeat(auto-fit, minmax(400px, 1fr)); gap: 20px; }
-.l7-view-container .kpi-row { display: grid; grid-template-columns: repeat(auto-fit, minmax(150px, 1fr)); gap: 20px; }
-.l7-view-container .kpi-card { background-color: #f9f9f9; border-radius: 8px; padding: 15px; text-align: center; border: 1px solid #e0e0e0; }
-.l7-view-container .kpi-card big { display: block; font-size: 1.8em; font-weight: bold; color: #3771c8; }
-.l7-view-container .kpi-card-label { font-size: 0.9em; color: #666; }
-.l7-view-container .chart-grid { display: grid; grid-template-columns: repeat(auto-fit, minmax(300px, 1fr)); gap: 20px; }
-.l7-view-container .chart-card { background-color: #ffffff; border-radius: 8px; padding: 20px; border: 1px solid #e0e0e0; }
-.l7-view-container .chart-card h4 { margin-top: 0; margin-bottom: 15px; text-align: center; font-size: 1.1em; }
-.l7-view-container .l7-controls { 
-	display: flex; 
-	justify-content: space-between; 
-	align-items: center; 
-	margin-top: 20px; 
-	padding: 15px 20px; 
-	background: linear-gradient(135deg, #667eea 0%, #764ba2 100%);
-	border-radius: 8px;
-	box-shadow: 0 4px 6px rgba(0,0,0,0.1);
-	color: white;
-}
-.l7-view-container .l7-controls-left, .l7-view-container .l7-controls-right { 
-	display: flex; 
-	align-items: center; 
-	gap: 15px; 
-}
-
-/* Display View Specific Styles */
-.display-view-container .dashboard-container { display: flex; flex-direction: column; gap: 20px; margin-bottom: 20px; }
-.display-view-container .kpi-row { display: grid; grid-template-columns: repeat(auto-fit, minmax(150px, 1fr)); gap: 20px; }
-.display-view-container .kpi-card { background-color: #f9f9f9; border-radius: 8px; padding: 15px; text-align: center; border: 1px solid #e0e0e0; }
-.display-view-container .kpi-card big { display: block; font-size: 1.8em; font-weight: bold; color: #3771c8; }
-.display-view-container .kpi-card-label { font-size: 0.9em; color: #666; }
-.display-view-container .chart-grid { display: grid; grid-template-columns: repeat(auto-fit, minmax(300px, 1fr)); gap: 20px; }
-.display-view-container .chart-card { background-color: #ffffff; border-radius: 8px; padding: 20px; border: 1px solid #e0e0e0; }
-.display-view-container .chart-card h4 { margin-top: 0; margin-bottom: 15px; text-align: center; font-size: 1.1em; }
-.display-view-container .display-controls { 
-	display: flex; 
-	justify-content: space-between; 
-	align-items: center; 
-	padding: 15px 20px; 
-	background: linear-gradient(135deg, #667eea 0%, #764ba2 100%);
-	border-radius: 8px;
-	box-shadow: 0 4px 6px rgba(0,0,0,0.1);
-	margin-top: 20px;
-}
-
-/* Control Groups */
-.control-group {
-	display: flex;
-	align-items: center;
-	gap: 8px;
-	padding: 8px 12px;
-	background-color: rgba(255, 255, 255, 0.15);
-	border-radius: 6px;
-	backdrop-filter: blur(10px);
-}
-
-.control-icon {
-	font-size: 1.2em;
-	display: inline-block;
-}
-
-.control-label {
-	font-weight: 500;
-	color: white;
-	margin: 0;
-	white-space: nowrap;
-}
-
-.control-input {
-	border-radius: 4px;
-	border: 1px solid rgba(255, 255, 255, 0.3);
-	background-color: rgba(255, 255, 255, 0.9);
-	padding: 6px 12px;
-	transition: all 0.3s ease;
-}
-
-.control-input:focus {
-	background-color: white;
-	border-color: #667eea;
-	box-shadow: 0 0 0 3px rgba(102, 126, 234, 0.2);
-	outline: none;
-}
-
-.control-buttons {
-	display: flex;
-	align-items: center;
-	gap: 10px;
-}
-
-.status-group {
-	background-color: rgba(255, 255, 255, 0.2);
-}
-
-.last-updated-text {
-	color: rgba(255, 255, 255, 0.95);
-	font-size: 0.9em;
-	font-weight: 500;
-}
-
-/* Enhanced Select Styling */
-.cbi-input-select {
-	padding: 6px 30px 6px 12px;
-	border-radius: 4px;
-	border: 1px solid rgba(255, 255, 255, 0.3);
-	background-color: rgba(255, 255, 255, 0.9);
-	background-image: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='12' height='12' viewBox='0 0 12 12'%3E%3Cpath fill='%23667eea' d='M6 9L1 4h10z'/%3E%3C/svg%3E");
-	background-repeat: no-repeat;
-	background-position: right 8px center;
-	background-size: 12px;
-	appearance: none;
-	cursor: pointer;
-	transition: all 0.3s ease;
-	font-weight: 500;
-}
-
-.cbi-input-select:hover {
-	background-color: white;
-	border-color: #667eea;
-}
-
-.cbi-input-select:focus {
-	background-color: white;
-	border-color: #667eea;
-	box-shadow: 0 0 0 3px rgba(102, 126, 234, 0.2);
-	outline: none;
-}
-
-/* Button Enhancements for Controls */
-.l7-controls .cbi-button,
-.display-controls .cbi-button {
-	padding: 8px 16px;
-	border-radius: 6px;
-	font-weight: 500;
-	transition: all 0.3s ease;
-	border: 2px solid transparent;
-}
-
-.cbi-button-action {
-	background: rgba(255, 193, 7, 0.9);
-	color: #333;
-	border-color: rgba(255, 193, 7, 0.3);
-}
-
-.cbi-button-action:hover {
-	background: #ffc107;
-	transform: translateY(-2px);
-	box-shadow: 0 4px 8px rgba(255, 193, 7, 0.4);
-}
-
-.cbi-button-positive {
-	background: rgba(40, 167, 69, 0.9);
-	color: white;
-	border-color: rgba(40, 167, 69, 0.3);
-}
-
-.cbi-button-positive:hover {
-	background: #28a745;
-	transform: translateY(-2px);
-	box-shadow: 0 4px 8px rgba(40, 167, 69, 0.4);
-}
-
-/* Responsive Controls */
-@media screen and (max-width: 768px) {
-	.l7-controls,
-	.display-controls {
-		flex-direction: column;
-		gap: 15px;
-	}
-	
-	.l7-controls-left,
-	.l7-controls-right,
-	.control-buttons {
-		width: 100%;
-		justify-content: center;
-	}
-	
-	.control-group {
-		justify-content: center;
-	}
-}
-
-/* Table Cell Icon Styles */
-.activity-indicator {
-	font-size: 12px;
-	display: inline-block;
-	margin-right: 2px;
-}
-
-.icon, .btn-icon, .th-icon {
-	display: inline-block;
-	font-style: normal;
-	margin-right: 4px;
-}
-
-.th-icon {
-	opacity: 0.7;
-}
-
-/* Cell Specific Styles */
-.sid-cell, .id-cell, .host-cell, .hostname-cell, .protocol-cell {
-	display: inline-flex;
-	align-items: center;
-	gap: 4px;
-}
-
-.speed-cell {
-	display: inline-flex;
-	align-items: center;
-	justify-content: flex-end;
-	gap: 4px;
-	font-weight: 500;
-	min-width: 100px;
-}
-
-.speed-cell.download {
-	color: #28a745;
-}
-
-.speed-cell.upload {
-	color: #007bff;
-}
-
-.volume-cell {
-	display: inline-flex;
-	align-items: center;
-	justify-content: flex-end;
-	gap: 4px;
-	min-width: 90px;
-}
-
-.volume-cell.download {
-	color: #17a2b8;
-}
-
-.volume-cell.upload {
-	color: #6610f2;
-}
-
-.packet-cell {
-	display: inline-flex;
-	align-items: center;
-	justify-content: flex-end;
-	gap: 4px;
-	color: #6c757d;
-	min-width: 80px;
-}
-
-/* Data value with monospace font for better alignment */
-.data-value {
-	font-family: 'Courier New', Consolas, monospace;
-	font-size: 0.95em;
-	letter-spacing: 0.5px;
-}
-
-/* Table header enhancements */
-.table .th {
-	font-weight: 600;
-	padding: 10px 8px;
-	white-space: nowrap;
-}
-
-.table .td {
-	padding: 8px;
-	vertical-align: middle;
-}
-
-.protocol-icon.l7::before {
-	content: '';
-	display: inline-block;
-	width: 8px;
-	height: 8px;
-	border-radius: 50%;
-	background-color: #5470c6;
-	margin-right: 4px;
-}
-
-.protocol-icon.domain::before {
-	content: '';
-	display: inline-block;
-	width: 8px;
-	height: 8px;
-	border-radius: 50%;
-	background-color: #91cc75;
-	margin-right: 4px;
-}
-
-/* Button Enhancements */
-.cbi-button {
-	display: inline-flex;
-	align-items: center;
-	gap: 4px;
-	transition: all 0.2s ease;
-}
-
-.cbi-button:hover {
-	transform: translateY(-1px);
-	box-shadow: 0 2px 4px rgba(0,0,0,0.1);
-}
-
-.cbi-button-edit {
-	background-color: #ffc107;
-	border-color: #ffc107;
-}
-
-.cbi-button-edit:hover {
-	background-color: #e0a800;
-	border-color: #e0a800;
-}
-
-.cbi-button-remove {
-	background-color: #dc3545;
-	border-color: #dc3545;
-	color: white;
-}
-
-.cbi-button-remove:hover {
-	background-color: #c82333;
-	border-color: #bd2130;
-}
-
-.cbi-button-add {
-	background-color: #28a745;
-	border-color: #28a745;
-	color: white;
-}
-
-.cbi-button-add:hover:not(:disabled) {
-	background-color: #218838;
-	border-color: #1e7e34;
-}
-
-.cbi-button-add:disabled {
-	opacity: 0.5;
-	cursor: not-allowed;
-}
-
-/* Table Row Hover Effects */
-.table .tr:not(.table-titles):not(.placeholder):hover {
-	background-color: #f8f9fa;
-	transition: background-color 0.2s ease;
-}
-
-/* Active/Inactive Status Styles */
-.activity-indicator[title*="Active"] {
-	animation: pulse 2s ease-in-out infinite;
-}
-
-@keyframes pulse {
-	0%, 100% { opacity: 1; }
-	50% { opacity: 0.5; }
-}
-
-/* Responsive Icon Handling */
-@media screen and (max-width: 768px) {
-	.icon, .btn-icon {
-		margin-right: 2px;
-	}
-	
-	.btn-icon + span {
-		display: none;
-	}
-	
-	.th-icon {
-		margin-right: 0;
-	}
-}

luci-app-apfree-wifidog/htdocs/luci-static/resources/view/wifidogx.js

@@ -30,219 +30,6 @@ var callGetWanMac = rpc.declare({
 	expect: { result: {} }
 });
 
-// Generate Device ID: AW + 7 random digits + 12-char MAC (total 21 chars)
-function generateDeviceId(macAddress) {
-	var macPart = macAddress.replace(/-/g, ''); // Remove hyphens from MAC
-	var randomPart = '';
-	for (var i = 0; i < 7; i++) {
-		randomPart += Math.floor(Math.random() * 10);
-	}
-	return 'AW' + randomPart + macPart;
-}
-
-// Generate Location ID: 14 digits (AAAAAABBBCCCCC)
-// AAAAAA: Administrative division code (GB/T 2260) - using Beijing as default (110101)
-// BBB: Service type (100 for commercial internet service locations, positions 7-9)
-// CCCCC: 5-digit random sequence number (positions 10-14)
-function generateLocationId() {
-	var adminCode = '110101'; // Default to Beijing Dongcheng District (positions 1-6)
-	var serviceType = '100'; // Commercial internet service location (positions 7-9)
-	var sequenceNum = '';
-
-	// Generate 5-digit random sequence number (positions 10-14)
-	for (var i = 0; i < 5; i++) {
-		sequenceNum += Math.floor(Math.random() * 10);
-	}
-
-	return adminCode + serviceType + sequenceNum; // 6 + 3 + 5 = 14 digits
-}
-
-// Auto-fill helper functions
-function showAutoFillModal() {
-	ui.showModal(_('Auto Fill'), [
-		E('div', { 'class': 'cbi-section' }, [
-			E('div', { 'class': 'cbi-section-descr' }, _('Getting device information and location data, please wait...')),
-			E('div', { 'id': 'auto-fill-progress' }, [
-				E('ul', { 'style': 'margin: 10px 0;' }, [
-					E('li', { 'id': 'mac-status' }, _('Getting WAN MAC address...')),
-					E('li', { 'id': 'device-id-status' }, _('Generating Device ID...')),
-					E('li', { 'id': 'location-id-status' }, _('Generating Location ID...')),
-					E('li', { 'id': 'location-status' }, _('Getting location coordinates...'))
-				])
-			])
-		])
-	]);
-}
-
-function updateMacStatus(macAddr, isSuccess, errorMsg, isFallback) {
-	var statusElement = document.getElementById('mac-status');
-	if (isSuccess) {
-		var prefix = isFallback ? _('✓ WAN MAC address obtained (fallback): ') : _('✓ WAN MAC address obtained: ');
-		var suffix = isFallback ? '' : _(' (interface: ') + arguments[4] + _(')');
-		statusElement.innerHTML = prefix + macAddr + suffix;
-	} else {
-		statusElement.innerHTML = _('✗ Failed to get WAN MAC address: ') + (errorMsg || _('Unknown error'));
-	}
-}
-
-function generateAndUpdateIds(macAddr) {
-	var deviceId = generateDeviceId(macAddr);
-	var locationId = generateLocationId();
-
-	document.getElementById('device-id-status').innerHTML = _('✓ Device ID generated: ') + deviceId;
-	document.getElementById('location-id-status').innerHTML = _('✓ Location ID generated: ') + locationId;
-
-	return { deviceId: deviceId, locationId: locationId };
-}
-
-function getMacAddressPromise(results) {
-	return callGetWanMac().then(function (response) {
-		if (response && response.status === 'success') {
-			var macAddr = response.mac.toUpperCase().replace(/:/g, '-');
-			results.macAddress = macAddr;
-			updateMacStatus(macAddr, true, null, false, response.interface);
-
-			var ids = generateAndUpdateIds(macAddr);
-			results.deviceId = ids.deviceId;
-			results.locationId = ids.locationId;
-		} else {
-			return getMacAddressFallback(results);
-		}
-	}).catch(function (error) {
-		return getMacAddressFallback(results);
-	});
-}
-
-function getMacAddressFallback(results) {
-	document.getElementById('mac-status').innerHTML = _('RPC failed, trying fallback...');
-
-	return fs.exec('/bin/sh', ['-c', 'ip route | grep default | awk \'{print $5}\' | head -n1 | xargs -I {} cat /sys/class/net/{}/address 2>/dev/null || echo "failed"']).then(function (response) {
-		if (response.code === 0 && response.stdout && response.stdout.trim() !== 'failed') {
-			var macAddr = response.stdout.trim().toUpperCase().replace(/:/g, '-');
-			results.macAddress = macAddr;
-			updateMacStatus(macAddr, true, null, true);
-
-			var ids = generateAndUpdateIds(macAddr);
-			results.deviceId = ids.deviceId;
-			results.locationId = ids.locationId;
-		} else {
-			updateMacStatus(null, false, _('Unknown error'));
-			document.getElementById('device-id-status').innerHTML = _('✗ Cannot generate Device ID without MAC address');
-		}
-	}).catch(function (error) {
-		updateMacStatus(null, false, error.message);
-		document.getElementById('device-id-status').innerHTML = _('✗ Cannot generate Device ID due to MAC error');
-	});
-}
-
-function formatCoordinate(coord) {
-	var num = parseFloat(coord).toFixed(6);
-	if (num >= 0) {
-		return num.padStart(10, '0');
-	} else {
-		return '-' + Math.abs(num).toFixed(6).padStart(9, '0');
-	}
-}
-
-function getLocationPromise(results) {
-	return callGetLocation().then(function (response) {
-		if (response && response.status === 'success') {
-			var lat = formatCoordinate(response.lat);
-			var lon = formatCoordinate(response.lon);
-
-			results.longitude = lon;
-			results.latitude = lat;
-			document.getElementById('location-status').innerHTML = _('✓ Location obtained: ') + lat + ', ' + lon;
-		} else {
-			var errorMsg = (response && response.message) ? response.message : _('Unknown error');
-			document.getElementById('location-status').innerHTML = _('✗ Failed to get location: ') + errorMsg;
-		}
-	}).catch(function (error) {
-		return getLocationFallback(results);
-	});
-}
-
-function getLocationFallback(results) {
-	document.getElementById('location-status').innerHTML = _('RPC failed, trying direct method...');
-
-	return fs.exec('/bin/sh', ['-c', 'curl -s --connect-timeout 10 --max-time 30 "https://ipapi.co/json" 2>/dev/null || curl -s --connect-timeout 10 --max-time 30 "http://ipinfo.io/json" 2>/dev/null || echo "failed"']).then(function (response) {
-		if (response.code === 0 && response.stdout && response.stdout.trim() !== 'failed') {
-			try {
-				var data = JSON.parse(response.stdout);
-				var lat, lon;
-
-				if (data.latitude && data.longitude) {
-					lat = formatCoordinate(data.latitude);
-					lon = formatCoordinate(data.longitude);
-				} else if (data.loc) {
-					var coords = data.loc.split(',');
-					lat = formatCoordinate(coords[0]);
-					lon = formatCoordinate(coords[1]);
-				}
-
-				if (lat && lon) {
-					results.longitude = lon;
-					results.latitude = lat;
-					document.getElementById('location-status').innerHTML = _('✓ Location obtained (fallback): ') + lat + ', ' + lon;
-				} else {
-					document.getElementById('location-status').innerHTML = _('✗ No valid coordinates found');
-				}
-			} catch (e) {
-				document.getElementById('location-status').innerHTML = _('✗ Failed to parse location data');
-			}
-		} else {
-			document.getElementById('location-status').innerHTML = _('✗ Failed to get location data');
-		}
-	}).catch(function (fallbackError) {
-		document.getElementById('location-status').innerHTML = _('✗ Error getting location: ') + fallbackError.message;
-	});
-}
-
-function fillFormFields(results) {
-	var successCount = 0;
-	var totalFields = 0;
-	var messages = [];
-	var fieldMappings = [
-		{ result: 'macAddress', selector: 'ap_mac_address', label: _('MAC Address: ') },
-		{ result: 'deviceId', selector: 'ap_device_id', label: _('Device ID: ') },
-		{ result: 'locationId', selector: 'location_id', label: _('Location ID: ') },
-		{ result: 'longitude', selector: 'ap_longitude', label: _('Longitude: ') },
-		{ result: 'latitude', selector: 'ap_latitude', label: _('Latitude: ') }
-	];
-
-	fieldMappings.forEach(function (mapping) {
-		if (results[mapping.result]) {
-			var field = document.querySelector('input[data-name="' + mapping.selector + '"]') ||
-				document.querySelector('input[name*="' + mapping.selector + '"]') ||
-				document.querySelector('input[id*="' + mapping.selector + '"]') ||
-				document.querySelector('#cbid\\.wifidogx\\.default\\.' + mapping.selector);
-
-			if (field) {
-				field.value = results[mapping.result];
-				field.dispatchEvent(new Event('input', { bubbles: true }));
-				field.dispatchEvent(new Event('change', { bubbles: true }));
-				successCount++;
-				messages.push(mapping.label + results[mapping.result]);
-			}
-			totalFields++;
-		}
-	});
-
-	return { successCount: successCount, totalFields: totalFields, messages: messages };
-}
-
-function showAutoFillResult(stats) {
-	ui.hideModal();
-
-	if (stats.successCount === stats.totalFields && stats.totalFields > 0) {
-		ui.addNotification(null, E('p', _('Auto fill completed successfully! All fields have been filled.') + '<br>' + stats.messages.join('<br>')), 'info');
-	} else if (stats.successCount > 0) {
-		ui.addNotification(null, E('p', _('Auto fill partially completed.') + ' ' + stats.successCount + '/' + stats.totalFields + ' ' + _('fields filled successfully.') + '<br>' + stats.messages.join('<br>')), 'warning');
-	} else {
-		ui.addNotification(null, E('p', _('Auto fill failed. No fields could be filled. Please check your network connection and try again.')), 'error');
-	}
-}
-
 function getServiceStatus() {
 	return L.resolveDefault(callServiceList('wifidogx'), {}).then(function (res) {
 		var isRunning = false;
@@ -253,6 +40,25 @@ function getServiceStatus() {
 	});
 }
 
+function generateDeviceId(macAddress) {
+	var macPart = macAddress.replace(/-/g, '');
+	var randomPart = '';
+	for (var i = 0; i < 7; i++) {
+		randomPart += Math.floor(Math.random() * 10);
+	}
+	return 'AW' + randomPart + macPart;
+}
+
+function generateLocationId() {
+	var adminCode = '110101';
+	var serviceType = '100';
+	var sequenceNum = '';
+	for (var i = 0; i < 5; i++) {
+		sequenceNum += Math.floor(Math.random() * 10);
+	}
+	return adminCode + serviceType + sequenceNum;
+}
+
 function renderStatus(isRunning) {
 	var renderHTML = "";
 	var spanTemp = '<em><span style="color:%s"><strong>%s %s</strong></span></em>';
@@ -284,7 +90,6 @@ return view.extend({
 		s.tab('gateway', _('Gateway Settings'));
 		s.tab('advanced', _('Advanced Settings'));
 		s.tab('rule', _('Rule Settings'));
-		s.tab('qos', _('QoS Settings'));
 		s.tab('location', _('Authentication Location Settings'));
 
 		// basic settings
@@ -368,7 +173,7 @@ return view.extend({
 		o = s.taboption('basic', form.Flag, 'disable_portal_auth', _('Disable Portal Authentication'),
 			_('When enabled, users can access the internet without portal authentication. Firewall redirect rules will not be created. Use this mode for pure traffic statistics without captive portal.'));
 		o.rmempty = false;
-		o.default = '1';
+		o.default = '0';
 
 		o = s.taboption('basic', form.ListValue, 'log_level', _('Log Level'),
 			_('The log level of the apfree-wifidog.'));
@@ -380,7 +185,7 @@ return view.extend({
 		o.value(2, _('Critical'));
 		o.value(1, _('Alert'));
 		o.value(0, _('Emergency'));
-		o.defaulValue = 0;
+		o.default = 0;
 		o.optional = false;
 
 		// gateway settings
@@ -392,7 +197,7 @@ return view.extend({
 		o = ss.option(form.Flag, 'gateway_auth_enabled', _('Auth Enabled'),
 			_('Enable the authentication of the gateway.'));
 		o.rmempty = false;
-		o.defaulValue = true;
+		o.default = true;
 
 		o = ss.option(widgets.DeviceSelect, 'gateway_name', _('Gateway Name'));
 		o.rmempty = false;
@@ -425,14 +230,14 @@ return view.extend({
 		o.datatype = 'uinteger';
 		o.rmempty = false;
 		o.optional = false;
-		o.defaulValue = 60;
+		o.default = 60;
 
 		o = s.taboption('advanced', form.Value, 'client_timeout', _('Client Timeout'),
 			_('The timeout of the client.'));
 		o.datatype = 'uinteger';
 		o.rmempty = false;
 		o.optional = false;
-		o.defaulValue = 5;
+		o.default = 5;
 
 		o = s.taboption('advanced', form.Flag, 'wired_passed', _('Wired Passed'),
 			_('Wired users do not need to authenticate to access the internet.'));
@@ -441,23 +246,30 @@ return view.extend({
 		o = s.taboption('advanced', form.Flag, 'apple_cna', _('Apple CNA'),
 			_('Enable Apple Captive Network Assistant.'));
 		o.rmempty = false;
-		o.defaulValue = false;
+		o.default = false;
 
 		o = s.taboption('advanced', form.Flag, 'js_filter', _('JS Filter'),
 			_('Enable JS redirect.'));
 		o.rmempty = false;
-		o.defaulValue = true;
+		o.default = true;
 
 		o = s.taboption('advanced', form.Flag, 'enable_anti_nat', _('Enable Anti NAT'),
 			_('Enable Anti NAT devices.'));
 		o.rmempty = false;
-		o.defaulValue = false;
+		o.default = false;
+
+		o = s.taboption('advanced', form.Value, 'privileged_ops_secret', _('Privileged Ops Secret'),
+			_('Local secret required for AWAS cloud platform to dynamically authorize remote OTA, reboot and system changes. Change this from the default on production devices.'));
+		o.password = true;
+		o.rmempty = false;
+		o.optional = false;
+		o.default = 'chawrt@2026';
 
 		o = s.taboption('advanced', form.Value, 'ttl_value', _('TTL Value'),
 			_('The TTL value of the gateway support.'));
 		o.datatype = 'string';
 		o.rmempty = false;
-		o.defaulValue = '64,128';
+		o.default = '64,128';
 		o.depends('enable_anti_nat', '1');
 
 		o = s.taboption('advanced', form.Value, 'anti_nat_permit_macs', _('Anti NAT Permit MAC'),
@@ -466,17 +278,87 @@ return view.extend({
 		o.rmempty = true;
 		o.depends('enable_anti_nat', '1');
 
-		o = s.taboption('advanced', form.Flag, 'enable_event_log', _('Enable Internet Access Log'),
-			_('Enable logging of internet access events and user activities.'));
-		o.rmempty = false;
-		o.defaulValue = false;
-
 		// Auth Server Settings
 		o = s.taboption('auth', form.SectionValue, '_auth', form.GridSection, 'auth');
 		ss = o.subsection;
 		ss.addremove = true;
 		ss.nodescriptions = true;
 
+		ss.handleAdd = function (ev, name) {
+			var self = this;
+			if (name) {
+				var longconnSections = uci.sections('wifidogx', 'longconn');
+				for (var i = 0; i < longconnSections.length; i++) {
+					if (longconnSections[i]['.name'] === name) {
+						ui.addNotification(null, E('p', _('The name "%s" already exists in Long Connection profiles. Please choose a different name.').format(name)), 'error');
+						return Promise.resolve();
+					}
+				}
+				var authSections = uci.sections('wifidogx', 'auth');
+				for (var i = 0; i < authSections.length; i++) {
+					if (authSections[i]['.name'] === name) {
+						ui.addNotification(null, E('p', _('The name "%s" already exists in Auth Server profiles. Please choose a different name.').format(name)), 'error');
+						return Promise.resolve();
+					}
+				}
+			}
+			return this.super('handleAdd', [ev, name]);
+		};
+
+		ss.handleRename = function (section_id, ev) {
+			var self = this;
+			var oldName = section_id;
+			var nameEl = E('input', {
+				'type': 'text',
+				'class': 'cbi-input-text',
+				'id': 'auth-rename-input',
+				'value': oldName,
+				'style': 'width: 100%;'
+			});
+			ui.showModal(_('Rename Authentication Server'), [
+				E('div', { 'class': 'cbi-section' }, [
+					E('div', { 'class': 'cbi-section-descr' }, _('Enter a new unique name for this authentication server profile.')),
+					E('div', { 'class': 'cbi-section-table' }, [
+						E('div', { 'class': 'tr' }, [
+							E('div', { 'class': 'td' }, _('Name')),
+							E('div', { 'class': 'td' }, [nameEl])
+						])
+					])
+				]),
+				E('div', { 'class': 'right' }, [
+					E('button', { 'class': 'btn', 'click': function () { ui.hideModal(); } }, _('Cancel')),
+					E('button', { 'class': 'btn cbi-button cbi-button-positive', 'click': function () {
+						var newName = nameEl.value.trim();
+						if (!newName) {
+							ui.addNotification(null, E('p', _('Please enter a name.')), 'error');
+							return;
+						}
+						if (newName === oldName) {
+							ui.hideModal();
+							return;
+						}
+						var longconnSections = uci.sections('wifidogx', 'longconn');
+						for (var i = 0; i < longconnSections.length; i++) {
+							if (longconnSections[i]['.name'] === newName) {
+								ui.addNotification(null, E('p', _('The name "%s" already exists in Long Connection profiles. Please choose a different name.').format(newName)), 'error');
+								return;
+							}
+						}
+						var authSections = uci.sections('wifidogx', 'auth');
+						for (var i = 0; i < authSections.length; i++) {
+							if (authSections[i]['.name'] === newName && authSections[i]['.name'] !== oldName) {
+								ui.addNotification(null, E('p', _('The name "%s" already exists in Auth Server profiles. Please choose a different name.').format(newName)), 'error');
+								return;
+							}
+						}
+						ui.hideModal();
+						uci.rename('wifidogx', section_id, newName);
+						self.map.save(null, true);
+					}}, _('Rename'))
+				])
+			]);
+		};
+
 		o = ss.option(form.Value, 'auth_server_hostname', _('Auth Server Hostname'),
 			_('The domain or IP address of the authentication server.'));
 		o.rmempty = false;
@@ -499,29 +381,6 @@ return view.extend({
 		o.optional = false;
 		o.default = '/wifidog/';
 
-
-		// QoS settings
-		o = s.taboption('qos', form.Flag, 'enable_qos', _('Enable Global QoS'),
-			_('Enable Global QoS.'));
-		o.rmempty = false;
-		o.defaulValue = false;
-
-		o = s.taboption('qos', form.Value, 'qos_up', _('Global QoS Up'),
-			_('The global QoS up value(Mbps).'));
-		o.datatype = 'uinteger';
-		o.rmempty = true;
-		o.optional = true;
-		o.defaulValue = 0;
-		o.depends('enable_qos', '1');
-
-		o = s.taboption('qos', form.Value, 'qos_down', _('Global QoS Down'),
-			_('The global QoS down value(Mbps).'));
-		o.datatype = 'uinteger';
-		o.rmempty = true;
-		o.optional = true;
-		o.defaulValue = 0;
-		o.depends('enable_qos', '1');
-
 		// Authentication Location Settings
 		// Add auto-fill button
 		o = s.taboption('location', form.Button, '_auto_fill', _('Auto Fill All Fields'),
@@ -544,11 +403,8 @@ return view.extend({
 				getLocationPromise(results)
 			];
 
-			// Wait for all promises to complete and fill form fields
 			Promise.all(promises).then(function () {
-				setTimeout(function () {
-					fillFormFields(results);
-				}, 2000);
+				fillFormFields(results);
 			});
 		};
 
@@ -583,10 +439,11 @@ return view.extend({
 					results.locationId = generateLocationId();
 					document.getElementById('location-id-status').innerHTML = _('✓ Location ID generated: ') + results.locationId;
 				} else {
+					document.getElementById('mac-status').innerHTML = _('RPC returned error, trying fallback...');
 					return getMacAddressFallback(results);
 				}
 			}).catch(function (error) {
-				document.getElementById('mac-status').innerHTML = _('✗ RPC call failed, trying fallback...');
+				document.getElementById('mac-status').innerHTML = _('RPC call failed, trying fallback...');
 				return getMacAddressFallback(results);
 			});
 		}
@@ -625,8 +482,8 @@ return view.extend({
 					formatAndSetCoordinates(results, lat, lon);
 					document.getElementById('location-status').innerHTML = _('✓ Location obtained: ') + results.latitude + ', ' + results.longitude;
 				} else {
-					var errorMsg = (response && response.message) ? response.message : 'Unknown error';
-					document.getElementById('location-status').innerHTML = _('✗ Failed to get location: ') + errorMsg;
+					document.getElementById('location-status').innerHTML = _('RPC returned error, trying fallback...');
+					return getLocationFallback(results);
 				}
 			}).catch(function (error) {
 				document.getElementById('location-status').innerHTML = _('RPC failed, trying direct method...');
@@ -741,8 +598,6 @@ return view.extend({
 		o.rmempty = false;
 		o.datatype = 'string';
 		o.optional = false;
-		o.depends('auth_server_mode', 'cloud');
-		o.depends('auth_server_mode', 'bypass');
 		o.placeholder = '110101100123456';
 		o.validate = function (section_id, value) {
 			if (!value || value === '')
@@ -766,7 +621,8 @@ return view.extend({
 
 			// Validate service type code (7-9 digits)
 			var serviceType = value.substring(6, 9);
-			if (serviceType !== '100' && serviceType !== '2' + value.charAt(7) + value.charAt(8) && serviceType !== '3' + value.charAt(7) + value.charAt(8)) {
+			var firstDigit = serviceType.charAt(0);
+			if (serviceType !== '100' && firstDigit !== '2' && firstDigit !== '3') {
 				return _('Service type code (7-9 digits) must be "100" for commercial internet service locations, "2XX" for non-commercial locations, or "3XX" for WiFi wireless collection terminals');
 			}
 
@@ -936,6 +792,81 @@ return view.extend({
 		ss.addremove = true;
 		ss.nodescriptions = true;
 
+		ss.handleAdd = function (ev, name) {
+			var self = this;
+			if (name) {
+				var authSections = uci.sections('wifidogx', 'auth');
+				for (var i = 0; i < authSections.length; i++) {
+					if (authSections[i]['.name'] === name) {
+						ui.addNotification(null, E('p', _('The name "%s" already exists in Auth Server profiles. Please choose a different name.').format(name)), 'error');
+						return Promise.resolve();
+					}
+				}
+				var longconnSections = uci.sections('wifidogx', 'longconn');
+				for (var i = 0; i < longconnSections.length; i++) {
+					if (longconnSections[i]['.name'] === name) {
+						ui.addNotification(null, E('p', _('The name "%s" already exists in Long Connection profiles. Please choose a different name.').format(name)), 'error');
+						return Promise.resolve();
+					}
+				}
+			}
+			return this.super('handleAdd', [ev, name]);
+		};
+
+		ss.handleRename = function (section_id, ev) {
+			var self = this;
+			var oldName = section_id;
+			var nameEl = E('input', {
+				'type': 'text',
+				'class': 'cbi-input-text',
+				'id': 'longconn-rename-input',
+				'value': oldName,
+				'style': 'width: 100%;'
+			});
+			ui.showModal(_('Rename Long Connection Profile'), [
+				E('div', { 'class': 'cbi-section' }, [
+					E('div', { 'class': 'cbi-section-descr' }, _('Enter a new unique name for this long connection profile.')),
+					E('div', { 'class': 'cbi-section-table' }, [
+						E('div', { 'class': 'tr' }, [
+							E('div', { 'class': 'td' }, _('Name')),
+							E('div', { 'class': 'td' }, [nameEl])
+						])
+					])
+				]),
+				E('div', { 'class': 'right' }, [
+					E('button', { 'class': 'btn', 'click': function () { ui.hideModal(); } }, _('Cancel')),
+					E('button', { 'class': 'btn cbi-button cbi-button-positive', 'click': function () {
+						var newName = nameEl.value.trim();
+						if (!newName) {
+							ui.addNotification(null, E('p', _('Please enter a name.')), 'error');
+							return;
+						}
+						if (newName === oldName) {
+							ui.hideModal();
+							return;
+						}
+						var authSections = uci.sections('wifidogx', 'auth');
+						for (var i = 0; i < authSections.length; i++) {
+							if (authSections[i]['.name'] === newName) {
+								ui.addNotification(null, E('p', _('The name "%s" already exists in Auth Server profiles. Please choose a different name.').format(newName)), 'error');
+								return;
+							}
+						}
+						var longconnSections = uci.sections('wifidogx', 'longconn');
+						for (var i = 0; i < longconnSections.length; i++) {
+							if (longconnSections[i]['.name'] === newName && longconnSections[i]['.name'] !== oldName) {
+								ui.addNotification(null, E('p', _('The name "%s" already exists in Long Connection profiles. Please choose a different name.').format(newName)), 'error');
+								return;
+							}
+						}
+						ui.hideModal();
+						uci.rename('wifidogx', section_id, newName);
+						self.map.save(null, true);
+					}}, _('Rename'))
+				])
+			]);
+		};
+
 		o = ss.option(form.ListValue, 'long_conn_mode', _('Connection Mode'),
 			_('The type of persistent connection to the remote management server.'));
 		o.value('ws', _('WebSocket (ws://)'));
@@ -1011,7 +942,7 @@ return view.extend({
 
 		// rule settings
 		o = s.taboption('rule', form.DynamicList, 'trusted_wildcard_domains', _('Trusted Wildcard Domains'),
-			_('The trusted wildcard domains of the gateway'));
+			_('Requires aw-bpf DNS XDP (dns_ringbuf_portal). Patterns like .example.com; resolved IPs are added to the captive portal firewall (inet wifidogx), not inet awbpf.'));
 		o.rmempty = true;
 		o.optional = true;
 		o.datatype = 'wildcard';
@@ -1025,7 +956,7 @@ return view.extend({
 		o.placeholder = 'www.example.com';
 
 		o = s.taboption('rule', form.DynamicList, 'trusted_macs', _('Trusted MACs'),
-			_('The trusted wildcard domains of the gateway.'));
+			_('The trusted MAC addresses of the gateway.'));
 		o.rmempty = true;
 		o.optional = true;
 		o.datatype = 'macaddr';

luci-app-apfree-wifidog/htdocs/luci-static/resources/view/wifidogx/display.js

@@ -1,650 +0,0 @@
-'use strict';
-'require view';
-'require fs';
-'require ui';
-'require poll';
-'require rpc';
-'require dom';
-'require uci';
-
-// Global variables from original display.js
-var chartRegistry = {};
-var hostNames = {}; // mac => hostname
-var hostInfo = {}; // ip => mac
-var hostNameMacSectionId = "";
-var isPaused = false;
-var lastUpdated = null;
-
-// Line chart variables (from l7.js)
-var downloadLineChart = {}, uploadLineChart = {};
-var lineCategories = { ipv4: [], ipv6: [], mac: [] };
-var downloadSeriesData = { ipv4: {}, ipv6: {}, mac: {} };
-var uploadSeriesData = { ipv4: {}, ipv6: {}, mac: {} };
-
-// Color palette for chart series
-var colorPalette = ['#5470c6', '#91cc75', '#fac858', '#ee6666', '#73c0de', '#3ba272', '#fc8452', '#9a60b4', '#ea7ccc'];
-
-var resizeListenerAdded = false;
-
-// Pre-fill with 60 empty points for a smooth start
-['ipv4', 'ipv6', 'mac'].forEach(function(type) {
-	for (var i = 0; i < 60; i++) {
-		lineCategories[type].push('');
-	}
-});
-
-// Helper to convert hex to rgba (from l7.js)
-function hexToRgba(hex, opacity) {
-	var result = /^#?([a-f\d]{2})([a-f\d]{2})([a-f\d]{2})$/i.exec(hex);
-	return result ? 
-		'rgba(' + parseInt(result[1], 16) + ', ' + parseInt(result[2], 16) + ', ' + parseInt(result[3], 16) + ', ' + opacity + ')' :
-		null;
-};
-
-return view.extend({
-	// --- Core Data Logic from display.js ---
-
-	loadHostNames: async function() {
-		try {
-			await uci.sections('hostnames', "hostname", function (params) {
-				hostNameMacSectionId = params['.name'];
-				for (var key in params) {
-					if (key.startsWith('.')) continue;
-					var macAddr = key.split('_').join(':');
-					hostNames[macAddr] = params[key];
-				}
-			});
-
-			const dhcpLeases = await fs.exec_direct('/usr/bin/awk', ['-F', ' ', '{print $2, $3, $4}', '/tmp/dhcp.leases'], 'text');
-			dhcpLeases.split('\n').forEach(function(line) {
-				if (line === '') return;
-				const [mac, ip, hostname] = line.split(' ');
-				if (!hostNames.hasOwnProperty(mac)) {
-					hostNames[mac] = hostname;
-				}
-			});
-
-			const arp = await fs.exec_direct('/usr/bin/awk', ['-F', ' ', '{print $1, $4}', '/proc/net/arp'], 'text');
-			arp.split('\n').forEach(function(line, i) {
-				if (i === 0 || line === '') return;
-				const [ip, mac] = line.split(' ');
-				hostInfo[ip] = mac;
-			});
-
-		} catch (e) {
-			console.error('Error getting host names:', e);
-		}
-	},
-
-	loadHostSpeedData: async function() {
-		var self = this;
-		try {
-			const results = await Promise.all([
-				fs.exec_direct('/usr/bin/aw-bpfctl', ['ipv4', 'json'], 'json'),
-				fs.exec_direct('/usr/bin/aw-bpfctl', ['ipv6', 'json'], 'json'),
-				fs.exec_direct('/usr/bin/aw-bpfctl', ['mac',  'json'], 'json')
-			]);
-
-			const defaultData = {status: "success", data: []};
-			const ipv4Data = results[0] || defaultData;
-			const ipv6Data = results[1] || defaultData;
-			const macData  = results[2] || defaultData;
-			
-			ipv4Data.data.forEach(function(item) {
-				const mac = hostInfo[item.ip];
-				if (mac) {
-					item.mac = mac;
-					item.hostname = hostNames[mac];
-				}
-			});
-			macData.data.forEach(function(item) {
-				const mac = item.mac;
-				if (mac) {
-					item.hostname = hostNames[mac];
-				}
-			});
-
-			self.renderHostSpeed(ipv4Data, "ipv4");
-			self.renderHostSpeed(ipv6Data, "ipv6");
-			self.renderHostSpeed(macData, "mac");
-
-			lastUpdated = new Date();
-			var timestampEl = document.getElementById('display-last-updated');
-			if (timestampEl) {
-				timestampEl.textContent = _('Last updated: %s').format(lastUpdated.toLocaleTimeString());
-			}
-
-		} catch (e) {
-			console.error('Error polling data:', e);
-		}
-	},
-
-	pollData: function() {
-		poll.add(L.bind(async function() {
-			if (isPaused) return;
-			await this.loadHostNames();
-			await this.loadHostSpeedData();
-		}, this), 5);
-	},
-
-	// --- UI Rendering and Interaction (New structure based on l7.js) ---
-
-	pie: function(id, data, valueFormatter) {
-		var total = data.reduce(function(n, d) { return n + d.value; }, 0);
-		data.sort(function(a, b) { return b.value - a.value; });
-
-		if (total === 0) {
-			data = [{ value: 1, color: '#cccccc', name: _('no traffic') }];
-		}
-
-		data.forEach(function(d, i) {
-			if (!d.color) {
-				var hue = (i * 137.508) % 360;
-				d.color = 'hsl(' + hue + ', 75%, 55%)';
-			}
-		});
-
-		var option = {
-			tooltip: {
-				trigger: 'item',
-				formatter: function(params) {
-					if (valueFormatter) {
-						// 将 ECharts params 对象转换为自定义格式
-						return valueFormatter({
-							name: params.name,
-							value: params.value,
-							percent: params.percent.toFixed(2)
-						});
-					}
-					return params.name + ': ' + params.value + ' (' + params.percent.toFixed(2) + '%)';
-				}
-			},
-			series: [{
-				type: 'pie',
-				radius: ['25%', '80%'],
-				avoidLabelOverlap: false,
-				padAngle: 10,
-				itemStyle: { borderRadius: 10, borderColor: '#fff', borderWidth: 2 },
-				label: { show: false, position: 'center' },
-				emphasis: { label: { show: true, fontSize: 14, fontWeight: 'bold' } },
-				labelLine: { show: false },
-				data: data.map(function(d) {
-					return { value: d.value, name: d.label || d.name, itemStyle: { color: d.color } };
-				})
-			}]
-		};
-
-		var dom = typeof id === 'string' ? document.getElementById(id) : id;
-		if (!chartRegistry[id]) {
-			chartRegistry[id] = echarts.init(dom);
-		}
-		chartRegistry[id].setOption(option, true);
-		return chartRegistry[id];
-	},
-
-	updateStackedLineCharts: function(type, perHostDownload, perHostUpload) {
-		var now = new Date().toLocaleTimeString();
-		lineCategories[type].push(now);
-		lineCategories[type].shift();
-
-		var processChartData = function(seriesData, perHostData) {
-			var allHosts = Object.keys(seriesData);
-			Object.keys(perHostData).forEach(function(host) {
-				if (allHosts.indexOf(host) === -1) {
-					allHosts.push(host);
-				}
-			});
-
-			allHosts.forEach(function(host) {
-				if (!seriesData[host]) {
-					seriesData[host] = Array(59).fill(0);
-				}
-				var rate = perHostData[host] || 0;
-				seriesData[host].push(rate);
-				seriesData[host].shift();
-			});
-
-			return Object.keys(seriesData).map(function(host, index) {
-				var color = colorPalette[index % colorPalette.length];
-				return {
-					name: host,
-					type: 'line',
-					stack: 'Total',
-					smooth: true,
-					lineStyle: { width: 1, color: color },
-					showSymbol: false,
-					itemStyle: { color: color },
-					areaStyle: {
-						color: new echarts.graphic.LinearGradient(0, 0, 0, 1, [
-							{ offset: 0, color: hexToRgba(color, 0.5) },
-							{ offset: 1, color: hexToRgba(color, 0) }
-						])
-					},
-					data: seriesData[host]
-				};
-			});
-		};
-
-		var downloadChartSeries = processChartData(downloadSeriesData[type], perHostDownload);
-		var uploadChartSeries = processChartData(uploadSeriesData[type], perHostUpload);
-
-		var legendData = downloadChartSeries.map(function(s) { return s.name; });
-
-		if (downloadLineChart[type]) {
-			downloadLineChart[type].setOption({
-				legend: { data: legendData, type: 'scroll', top: 0, left: 'center' },
-				series: downloadChartSeries,
-				xAxis: { data: lineCategories[type] }
-			});
-		}
-
-		if (uploadLineChart[type]) {
-			uploadLineChart[type].setOption({
-				legend: { data: legendData, type: 'scroll', top: 0, left: 'center' },
-				series: uploadChartSeries,
-				xAxis: { data: lineCategories[type] }
-			});
-		}
-	},
-
-	renderHostSpeed: function(data, type) {
-		if (!data || data.status !== "success" || !Array.isArray(data.data)) return;
-
-		var rows = [];
-		var txRateData = [], rxRateData = [];
-		var txVolumeData = [], rxVolumeData = [];
-		var tx_rate_total = 0, rx_rate_total = 0;
-		var tx_bytes_total = 0, rx_bytes_total = 0;
-		var perHostTxRate = {};
-		var perHostRxRate = {};
-
-		data.data.forEach(item => {
-			if (!item || !item.incoming || !item.outgoing) return;
-
-			var host = item.ip || item.mac || '';
-			var hostname = item.hostname || hostNames[item.mac] || '';
-			var displayName = hostname || host;
-			
-			// 判断连接是否活跃
-			var isActive = item.incoming.rate > 0 || item.outgoing.rate > 0;
-			var activityIcon = isActive ? '🟢' : '⚪';
-
-			rows.push([
-				E('span', { 'class': 'host-cell' }, [
-					E('span', { 'class': 'activity-indicator', 'title': isActive ? _('Active') : _('Inactive') }, activityIcon),
-					E('span', {}, ' ' + host)
-				]),
-				E('span', { 'class': 'hostname-cell' }, [
-					E('span', { 'class': 'icon' }, hostname ? '👤' : '❓'),
-					E('span', {}, ' ' + (hostname || _('Unknown')))
-				]),
-				E('span', { 'class': 'speed-cell download' }, [
-					E('span', { 'class': 'data-value' }, '%1024.2mBps'.format(item.incoming.rate))
-				]),
-				E('span', { 'class': 'volume-cell download' }, [
-					E('span', { 'class': 'data-value' }, '%1024.2mB'.format(item.incoming.total_bytes))
-				]),
-				E('span', { 'class': 'packet-cell download' }, [
-					E('span', { 'class': 'data-value' }, '%1000.2mP'.format(item.incoming.total_packets))
-				]),
-				E('span', { 'class': 'speed-cell upload' }, [
-					E('span', { 'class': 'data-value' }, '%1024.2mBps'.format(item.outgoing.rate))
-				]),
-				E('span', { 'class': 'volume-cell upload' }, [
-					E('span', { 'class': 'data-value' }, '%1024.2mB'.format(item.outgoing.total_bytes))
-				]),
-				E('span', { 'class': 'packet-cell upload' }, [
-					E('span', { 'class': 'data-value' }, '%1000.2mP'.format(item.outgoing.total_packets))
-				]),
-				E('div', { 'class': 'button-container' }, [
-					E('button', {
-						'class': 'btn cbi-button cbi-button-edit',
-						'style': 'margin-right: 5px;',
-						'click': ui.createHandlerFn(this, () => this.handleEditSpeed(host, item.mac, hostname, type))
-					}, [
-						E('span', { 'class': 'btn-icon' }, '✏️'),
-						E('span', {}, ' ' + _('Edit'))
-					]),
-					E('button', {
-						'class': 'btn cbi-button cbi-button-remove',
-						'click': ui.createHandlerFn(this, () => this.handleDeleteHost(host, type))
-					}, [
-						E('span', { 'class': 'btn-icon' }, '🗑️'),
-						E('span', {}, ' ' + _('Delete'))
-					])
-				])
-			]);
-			rx_rate_total += item.outgoing.rate;
-			tx_rate_total += item.incoming.rate;
-			rx_bytes_total += item.outgoing.total_bytes;
-			tx_bytes_total += item.incoming.total_bytes;
-
-			rxRateData.push({ value: item.outgoing.rate, label: displayName });
-			txRateData.push({ value: item.incoming.rate, label: displayName });
-			rxVolumeData.push({ value: item.outgoing.total_bytes, label: displayName });
-			txVolumeData.push({ value: item.incoming.total_bytes, label: displayName });
-
-			perHostTxRate[displayName] = (perHostTxRate[displayName] || 0) + item.incoming.rate;
-			perHostRxRate[displayName] = (perHostRxRate[displayName] || 0) + item.outgoing.rate;
-		});
-
-		this.updateStackedLineCharts(type, perHostTxRate, perHostRxRate);
-
-		var table = document.getElementById(type + '-speed-data');
-		cbi_update_table(table, rows, E('em', _('No data recorded yet.')));
-
-		this.pie(type + '-tx-rate-pie', txRateData, (p) => `${p.name}: ${'%1024.2mBps'.format(p.value)} (${p.percent}%)`);
-		this.pie(type + '-rx-rate-pie', rxRateData, (p) => `${p.name}: ${'%1024.2mBps'.format(p.value)} (${p.percent}%)`);
-		this.pie(type + '-tx-volume-pie', txVolumeData, (p) => `${p.name}: ${'%1024.2mB'.format(p.value)} (${p.percent}%)`);
-		this.pie(type + '-rx-volume-pie', rxVolumeData, (p) => `${p.name}: ${'%1024.2mB'.format(p.value)} (${p.percent}%)`);
-
-		var hostEl = document.getElementById(type + '-host-val');
-		if (hostEl) hostEl.textContent = data.data.length;
-
-		var txRateEl = document.getElementById(type + '-tx-rate-val');
-		if (txRateEl) txRateEl.textContent = '%1024.2mBps'.format(tx_rate_total);
-
-		var rxRateEl = document.getElementById(type + '-rx-rate-val');
-		if (rxRateEl) rxRateEl.textContent = '%1024.2mBps'.format(rx_rate_total);
-
-		var txVolEl = document.getElementById(type + '-tx-volume-val');
-		if (txVolEl) txVolEl.textContent = '%1024.2mB'.format(tx_bytes_total);
-
-		var rxVolEl = document.getElementById(type + '-rx-volume-val');
-		if (rxVolEl) rxVolEl.textContent = '%1024.2mB'.format(rx_bytes_total);
-	},
-
-	// --- Interaction Handlers from display.js ---
-
-	handleDeleteHost: function(host, type) {
-		ui.showModal(_('Delete Host'), [
-			E('p', _('Are you sure you want to delete this host?')),
-			E('div', { 'class': 'right' }, [
-				E('button', { 'class': 'btn', 'click': ui.hideModal }, _('Cancel')),
-				E('button', { 'class': 'btn cbi-button-negative', 'click': ui.createHandlerFn(this, async () => {
-					try {
-						await fs.exec_direct('/usr/bin/aw-bpfctl', [type, 'del', host], 'text');
-						this.loadHostSpeedData();
-						ui.hideModal();
-					} catch (e) {
-						ui.addNotification(null, E('p', _('Error: ') + e.message));
-						ui.hideModal();
-					}
-				})}, _('Delete'))
-			])
-		]);
-	},
-
-	handleEditSpeed: function(host, mac, hostname, type) {
-		fs.exec_direct('/usr/bin/aw-bpfctl', [type, 'json'], 'json').then(L.bind(res => {
-			let rate_limit_dl = 0, rate_limit_ul = 0;
-			if (res && res.status === 'success' && Array.isArray(res.data)) {
-				const item = res.data.find(d => (d.ip === host || d.mac === host));
-				if (item) {
-					rate_limit_dl = (item.incoming.incoming_rate_limit || 0) / 1024 / 1024;
-					rate_limit_ul = (item.outgoing.outgoing_rate_limit || 0) / 1024 / 1024;
-				}
-			}
-			this.displaySpeedLimitDialog(host, mac, hostname, type, rate_limit_dl, rate_limit_ul);
-		}, this)).catch(e => {
-			console.error('Error getting speed limit:', e);
-			this.displaySpeedLimitDialog(host, mac, hostname, type, 0, 0);
-		});
-	},
-	
-	displaySpeedLimitDialog: function(host, mac, hostname, type, dl, ul) {
-		const inputDom = E('input', { type: 'text', id: 'host-name', class: 'cbi-input-text', value: hostname, disabled: !mac });
-
-		ui.showModal(_('Edit Speed Limit'), [
-			E('div', { 'class': 'form-group' }, [ E('label', { 'class': 'form-label' }, _('Host')), E('span',{}, host) ]),
-			E('div', { 'class': 'form-group' }, [ E('label', { 'class': 'form-label' }, _('Hostname')), inputDom ]),
-			E('div', { 'class': 'form-group' }, [
-				E('label', { 'class': 'form-label' }, _('Download Limit')),
-				E('input', { type: 'number', id: 'dl-rate', class: 'cbi-input-number', min: '0', value: dl }),
-				E('span',{}, " Mbps")
-			]),
-			E('div', { 'class': 'form-group' }, [
-				E('label', { 'class': 'form-label' }, _('Upload Limit')),
-				E('input', { type: 'number', id: 'ul-rate', class: 'cbi-input-number', min: '0', value: ul }),
-				E('span',{}, " Mbps")
-			]),
-			E('div', { 'class': 'cbi-page-actions right' }, [
-				E('button', { 'class': 'btn cbi-button cbi-button-neutral', 'click': ui.hideModal }, _('Cancel')),
-				E('button', { 'class': 'btn cbi-button cbi-button-positive', 'click': ui.createHandlerFn(this, async ev => {
-					const dl_val = document.getElementById('dl-rate').value;
-					const ul_val = document.getElementById('ul-rate').value;
-					const newName = document.getElementById('host-name').value;
-					try {
-						if (mac && newName !== hostname) {
-							hostNames[mac] = newName;
-							await uci.set('hostnames', hostNameMacSectionId, mac.split(':').join('_'), newName);
-							await uci.save('hostnames');
-							await uci.apply('hostnames');
-						}
-						await fs.exec_direct('/usr/bin/aw-bpfctl', [type, 'update', host, "downrate", dl_val*1024*1024 || '0', "uprate", ul_val*1024*1024 || '0']);
-						this.loadHostSpeedData();
-						ui.addNotification(null, E('p',_('Speed limit updated')));
-						ui.hideModal();
-					} catch (e) {
-						ui.addNotification(null, E('p', _('Error: ') + e.message));
-					}
-				})}, _('Save'))
-			])
-		]);
-	},
-
-	validateData: function(value, type) {
-		if (typeof value !== 'string') return false;
-		const ipv4Regex = /^((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\.){3}(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)$/;
-		const ipv6Regex = /^([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}$|^(([0-9a-fA-F]{1,4}:){0,6}::([0-9a-fA-F]{1,4}:){0,6}[0-9a-fA-F]{1,4})$/i;
-		const macRegex = /^([0-9A-Fa-f]{2}([-:]))([0-9A-Fa-f]{2}\2){4}[0-9A-Fa-f]{2}$|^([0-9A-Fa-f]{12})$/i;
-		return (type === 'ipv4') ? ipv4Regex.test(value) : (type === 'ipv6') ? ipv6Regex.test(value) : macRegex.test(value);
-	},
-
-	createAddControls: function(type, placeholder) {
-		const input = E('input', { 
-			type: 'text', 
-			class: 'cbi-input-text control-input', 
-			style: (type === 'ipv6') ? 'width:320px' : 'width:180px', 
-			placeholder: _(placeholder) 
-		});
-		const addBtn = E('button', { 
-			class: 'btn cbi-button cbi-button-add', 
-			disabled: true 
-		}, [
-			E('span', { 'class': 'btn-icon' }, '➕'),
-			E('span', {}, ' ' + _('Add'))
-		]);
-		const refreshBtn = E('button', { 
-			class: 'btn cbi-button cbi-button-action', 
-			click: () => this.loadHostSpeedData() 
-		}, [
-			E('span', { 'class': 'btn-icon' }, '🔄'),
-			E('span', {}, ' ' + _('Refresh'))
-		]);
-
-		input.addEventListener('input', () => { addBtn.disabled = (input.value.trim() === ''); });
-		addBtn.addEventListener('click', ui.createHandlerFn(this, async () => {
-			const value = input.value.trim();
-			if (!this.validateData(value, type)) {
-				return ui.addNotification(null, E('p', _('Data format error')));
-			}
-			try {
-				await fs.exec_direct('/usr/bin/aw-bpfctl', [type, 'add', value]);
-				this.loadHostSpeedData();
-				ui.addNotification(null, E('p',_('Updated successfully!')));
-				input.value = '';
-				addBtn.disabled = true;
-			} catch (e) {
-				ui.addNotification(null, E('p', _('Error: ') + e.message));
-			}
-		}));
-
-		return E('div', { 'class': 'display-controls' }, [
-			E('div', { 'class': 'control-group' }, [
-				E('span', { 'class': 'control-icon' }, '🖥️'),
-				E('label', { 'class': 'control-label' }, _('Add Host:')),
-				input
-			]),
-			E('div', { 'class': 'control-buttons' }, [
-				addBtn,
-				refreshBtn,
-				E('div', { 'class': 'control-group status-group' }, [
-					E('span', { 'class': 'control-icon' }, '🕐'),
-					E('span', { 'id': 'display-last-updated', 'class': 'last-updated-text' }, _('Ready'))
-				])
-			])
-		]);
-	},
-
-	initializeUI: function() {
-		if (window.echarts) {
-			var self = this;
-			['ipv4', 'ipv6', 'mac'].forEach(function(type) {
-				var dlChartEl = document.getElementById(type + '-download-speed-line-chart');
-				var ulChartEl = document.getElementById(type + '-upload-speed-line-chart');
-				if (!dlChartEl || !ulChartEl) return;
-
-				var baseChartOption = {
-					tooltip: {
-						trigger: 'axis',
-						formatter: function (params) {
-							if (!params || params.length === 0) {
-								return null;
-							}
-							var tooltipContent = params[0].axisValueLabel + '<br/>';
-							params.sort(function(a, b) { return b.value - a.value; });
-							params.forEach(function(item) {
-								if (item.value > 0) {
-									tooltipContent += item.marker + ' ' + item.seriesName + ': ' + '%1024.2mBps'.format(item.value) + '<br/>';
-								}
-							});
-							return tooltipContent;
-						}
-					},
-					grid: { left: '3%', right: '4%', bottom: '10%', top: '50px', containLabel: true },
-					xAxis: { type: 'category', boundaryGap: false, data: lineCategories[type] },
-					yAxis: { type: 'value', axisLabel: { formatter: function(val) { return '%1024.2mBps'.format(val); } } },
-					series: []
-				};
-
-				downloadLineChart[type] = echarts.init(dlChartEl);
-				downloadLineChart[type].setOption(baseChartOption);
-
-				uploadLineChart[type] = echarts.init(ulChartEl);
-				uploadLineChart[type].setOption(baseChartOption);
-			});
-
-			// 添加窗口大小变化监听器，使图表能够响应式调整
-			if (!resizeListenerAdded) {
-				var resizeTimer = null;
-				var resizeHandler = function() {
-					// 使用防抖，避免频繁触发 resize
-					if (resizeTimer) {
-						clearTimeout(resizeTimer);
-					}
-					resizeTimer = setTimeout(function() {
-						// 调整折线图大小
-						['ipv4', 'ipv6', 'mac'].forEach(function(type) {
-							if (downloadLineChart[type]) {
-								downloadLineChart[type].resize();
-							}
-							if (uploadLineChart[type]) {
-								uploadLineChart[type].resize();
-							}
-						});
-						// 调整饼图大小
-						Object.keys(chartRegistry).forEach(function(chartId) {
-							if (chartRegistry[chartId]) {
-								chartRegistry[chartId].resize();
-							}
-						});
-					}, 200);
-				};
-				
-				window.addEventListener('resize', resizeHandler);
-				resizeListenerAdded = true;
-			}
-
-			this.pollData();
-		} else {
-			setTimeout(this.initializeUI.bind(this), 50);
-		}
-	},
-
-	// --- Main Render Function (New) ---
-
-	render: function() {
-		var self = this;
-
-		const createTab = (type, title, placeholder) => {
-			return E('div', { 'class': 'cbi-section', 'data-tab': type, 'data-tab-title': _(title) }, [
-				E('div', { 'class': 'dashboard-container' }, [
-					E('div', { 'class': 'line-chart-row' }, [
-						E('div', { 'class': 'chart-card' }, [
-							E('h4', [_('Real-time Download Speed')]),
-							E('div', { id: type + '-download-speed-line-chart', style: 'width: 100%; height: 350px;' })
-						]),
-						E('div', { 'class': 'chart-card' }, [
-							E('h4', [_('Real-time Upload Speed')]),
-							E('div', { id: type + '-upload-speed-line-chart', style: 'width: 100%; height: 350px;' })
-						])
-					]),
-					E('div', { 'class': 'kpi-row' }, [
-						E('div', { 'class': 'kpi-card' }, [ E('big', { id: type + '-host-val' }, '0'), E('span', { 'class': 'kpi-card-label' }, _('Hosts')) ]),
-						E('div', { 'class': 'kpi-card' }, [ E('big', { id: type + '-tx-rate-val' }, '0'), E('span', { 'class': 'kpi-card-label' }, _('Download Speed')) ]),
-						E('div', { 'class': 'kpi-card' }, [ E('big', { id: type + '-rx-rate-val' }, '0'), E('span', { 'class': 'kpi-card-label' }, _('Upload Speed')) ]),
-						E('div', { 'class': 'kpi-card' }, [ E('big', { id: type + '-tx-volume-val' }, '0'), E('span', { 'class': 'kpi-card-label' }, _('Download Total')) ]),
-						E('div', { 'class': 'kpi-card' }, [ E('big', { id: type + '-rx-volume-val' }, '0'), E('span', { 'class': 'kpi-card-label' }, _('Upload Total')) ])
-					]),
-					E('div', { 'class': 'chart-grid' }, [
-						E('div', { 'class': 'chart-card' }, [ E('h4', [_('Download Speed / Host')]), E('div', { id: type + '-tx-rate-pie', style: 'width:100%; height:300px;' }) ]),
-						E('div', { 'class': 'chart-card' }, [ E('h4', [_('Upload Speed / Host')]), E('div', { id: type + '-rx-rate-pie', style: 'width:100%; height:300px;' }) ]),
-						E('div', { 'class': 'chart-card' }, [ E('h4', [_('Download Total')]), E('div', { id: type + '-tx-volume-pie', style: 'width:100%; height:300px;' }) ]),
-						E('div', { 'class': 'chart-card' }, [ E('h4', [_('Upload Total')]), E('div', { id: type + '-rx-volume-pie', style: 'width:100%; height:300px;' }) ])
-					])
-				]),
-				E('table', { 'class': 'table', 'id': type + '-speed-data' }, [
-					E('tr', { 'class': 'tr table-titles' }, [
-						E('th', { 'class': 'th left' }, [ E('span', { 'class': 'th-icon' }, '🖥️'), ' ', _('Host') ]),
-						E('th', { 'class': 'th left' }, [ E('span', { 'class': 'th-icon' }, '👤'), ' ', _('Hostname') ]),
-						E('th', { 'class': 'th right' }, [ E('span', { 'class': 'th-icon' }, '⬇️'), ' ', _('Download Speed') ]),
-						E('th', { 'class': 'th right' }, [ E('span', { 'class': 'th-icon' }, '📦'), ' ', _('Download Total') ]),
-						E('th', { 'class': 'th right' }, [ E('span', { 'class': 'th-icon' }, '📨'), ' ', _('Download Packets') ]),
-						E('th', { 'class': 'th right' }, [ E('span', { 'class': 'th-icon' }, '⬆️'), ' ', _('Upload Speed') ]),
-						E('th', { 'class': 'th right' }, [ E('span', { 'class': 'th-icon' }, '📦'), ' ', _('Upload Total') ]),
-						E('th', { 'class': 'th right' }, [ E('span', { 'class': 'th-icon' }, '📨'), ' ', _('Upload Packets') ]),
-						E('th', { 'class': 'th center' }, [ E('span', { 'class': 'th-icon' }, '⚙️'), ' ', _('Actions') ])
-					]),
-					E('tr', { 'class': 'tr placeholder' }, [ E('td', { 'class': 'td', 'colspan': '9' }, [ E('em', { 'class': 'spinning' }, [ _('Collecting data...') ]) ]) ])
-				]),
-				self.createAddControls(type, placeholder)
-			]);
-		};
-
-		var tabContainer = E('div', {}, [
-			createTab('ipv4', 'IPv4', 'Please enter a valid IPv4 address'),
-			createTab('ipv6', 'IPv6', 'Please enter a valid IPv6 address'),
-			createTab('mac', 'MAC', 'Please enter a valid MAC address')
-		]);
-
-		var node = E([], [
-		    E('link', { 'rel': 'stylesheet', 'href': L.resource('view/wifidogx.css') }),
-		    E('script', { 'type': 'text/javascript', 'src': L.resource('echarts.min.js') }),
-		    E('div', { 'class': 'l7-view-container' }, [
-		        E('h2', [ _('Auth User Speed Monitor') ]),
-		        tabContainer
-		    ])
-		]);
-
-		ui.tabs.initTabGroup(tabContainer.childNodes);
-
-		setTimeout(() => this.initializeUI(), 0);
-
-		return node;
-	},
-
-	handleSave: null,
-	handleSaveApply: null,
-	handleReset: null
-});

luci-app-apfree-wifidog/htdocs/luci-static/resources/view/wifidogx/status.js

@@ -266,14 +266,14 @@ return view.extend({
             }
         }
 
+        // Initial update
+        updateStatus();
+
         // Poll status every 5 seconds
         L.Poll.add(function() {
             return updateStatus();
         }, 5);
 
-        // Initial update
-        updateStatus();
-
         return container;
     },
 

luci-app-apfree-wifidog/htdocs/luci-static/resources/view/xdpi/l7.js

@@ -1,695 +0,0 @@
-'use strict';
-'require view';
-'require fs';
-'require ui';
-'require poll';
-'require rpc';
-'require dom';
-
-var chartRegistry = {};
-var downloadLineChart, uploadLineChart;
-
-// Data structures for stacked line charts
-var lineCategories = [];
-var downloadSeriesData = {};
-var uploadSeriesData = {};
-
-// Color palette for chart series
-var colorPalette = ['#5470c6', '#91cc75', '#fac858', '#ee6666', '#73c0de', '#3ba272', '#fc8452', '#9a60b4', '#ea7ccc'];
-
-var currentSortInfo = {
-	table: null,
-	column: null,
-	reverse: false
-};
-var sidLookupTable = {};
-var isPaused = false;
-var lastUpdated = null;
-var pollActive = false;
-var lastSIDData = null;
-var resizeListenerAdded = false;
-var resizeTimer = null;
-
-// Pre-fill with 60 empty points for a smooth start
-for (var i = 0; i < 60; i++) {
-	lineCategories.push('');
-}
-
-// Helper to convert hex to rgba
-function hexToRgba(hex, opacity) {
-	var result = /^#?([a-f\d]{2})([a-f\d]{2})([a-f\d]{2})$/i.exec(hex);
-	return result ? 
-		'rgba(' + parseInt(result[1], 16) + ', ' + parseInt(result[2], 16) + ', ' + parseInt(result[3], 16) + ', ' + opacity + ')' :
-		null;
-};
-
-return view.extend({
-	load: function() {
-		return Promise.all([
-			this.loadSIDData(),
-			this.loadL7ProtoData()
-		]);
-	},
-
-	showError: function(message) {
-		var errorEl = document.getElementById('l7-error-message');
-		if (errorEl) {
-			errorEl.textContent = message;
-			errorEl.style.display = 'block';
-		}
-	},
-
-	hideError: function() {
-		var errorEl = document.getElementById('l7-error-message');
-		if (errorEl) {
-			errorEl.style.display = 'none';
-		}
-	},
-
-	loadSIDData: function() {
-		var self = this;
-		return fs.exec_direct('/usr/bin/aw-bpfctl', ['sid', 'json'], 'json').then(function(result) {
-			self.hideError();
-			lastSIDData = result;
-			return result;
-		}).catch(function(error) {
-			console.error('Error loading SID data:', error);
-			self.showError(_('Error loading SID data: %s').format(error.message));
-			return { status: 'error', data: [] };
-		});
-	},
-
-	loadL7ProtoData: function() {
-		var self = this;
-		return fs.exec_direct('/usr/bin/aw-bpfctl', ['l7', 'json'], 'json').then(function(result) {
-			self.hideError();
-			return result;
-		}).catch(function(error) {
-			console.error('Error loading L7 protocol data:', error);
-			self.showError(_('Error loading L7 protocol data: %s').format(error.message));
-			return { status: 'error', data: [] };
-		});
-	},
-
-	updateStackedLineCharts: function(perServiceDownload, perServiceUpload) {
-		var now = new Date().toLocaleTimeString();
-		lineCategories.push(now);
-		lineCategories.shift();
-	
-		var processChartData = function(seriesData, perServiceData) {
-			var allServices = Object.keys(seriesData);
-			Object.keys(perServiceData).forEach(function(service) {
-				if (allServices.indexOf(service) === -1) {
-					allServices.push(service);
-				}
-			});
-	
-			allServices.forEach(function(service) {
-				if (!seriesData[service]) {
-					seriesData[service] = Array(59).fill(0);
-				}
-				var rate = perServiceData[service] || 0;
-				seriesData[service].push(rate);
-				seriesData[service].shift();
-			});
-	
-			return Object.keys(seriesData).map(function(service, index) {
-				var color = colorPalette[index % colorPalette.length];
-				return {
-					name: service,
-					type: 'line',
-					stack: 'Total',
-					smooth: true,
-					lineStyle: { width: 1, color: color },
-					showSymbol: false,
-					itemStyle: { color: color },
-					areaStyle: {
-						color: new echarts.graphic.LinearGradient(0, 0, 0, 1, [
-							{ offset: 0, color: hexToRgba(color, 0.5) },
-							{ offset: 1, color: hexToRgba(color, 0) }
-						])
-					},
-					data: seriesData[service]
-				};
-			});
-		};
-	
-		var downloadChartSeries = processChartData(downloadSeriesData, perServiceDownload);
-		var uploadChartSeries = processChartData(uploadSeriesData, perServiceUpload);
-	
-		var legendData = downloadChartSeries.map(function(s) { return s.name; });
-
-		if (downloadLineChart) {
-			downloadLineChart.setOption({
-				legend: { data: legendData, type: 'scroll', top: 0, left: 'center' },
-				series: downloadChartSeries,
-				xAxis: { data: lineCategories }
-			});
-		}
-	
-		if (uploadLineChart) {
-			uploadLineChart.setOption({
-				legend: { data: legendData, type: 'scroll', top: 0, left: 'center' },
-				series: uploadChartSeries,
-				xAxis: { data: lineCategories }
-			});
-		}
-	},
-
-	pie: function(id, data, valueFormatter) {
-		var total = data.reduce(function(n, d) { return n + d.value; }, 0);
-
-		data.sort(function(a, b) { return b.value - a.value; });
-
-		if (total === 0) {
-			data = [{ value: 1, color: '#cccccc', name: _('no traffic') }];
-		}
-
-		data.forEach(function(d, i) {
-			if (!d.color) {
-				var hue = (i * 137.508) % 360;
-				d.color = 'hsl(' + hue + ', 75%, 55%)';
-			}
-		});
-
-		var option = {
-			tooltip: {
-				trigger: 'item',
-				formatter: function(params) {
-					if (valueFormatter) {
-						// 将 ECharts params 对象转换为自定义格式
-						return valueFormatter({
-							name: params.name,
-							value: params.value,
-							percent: params.percent.toFixed(2)
-						});
-					}
-					return params.name + ': ' + params.value + ' (' + params.percent.toFixed(2) + '%)';
-				}
-			},
-			series: [{
-				type: 'pie',
-				radius: ['25%', '80%'],
-				avoidLabelOverlap: false,
-				padAngle: 10,
-				itemStyle: { borderRadius: 10, borderColor: '#fff', borderWidth: 2 },
-				label: { show: false, position: 'center' },
-				emphasis: { label: { show: true, fontSize: 14, fontWeight: 'bold' } },
-				labelLine: { show: false },
-				data: data.map(function(d) {
-					return { value: d.value, name: d.label || d.name, itemStyle: { color: d.color } };
-				})
-			}]
-		};
-
-		var dom = typeof id === 'string' ? document.getElementById(id) : id;
-
-		if (!chartRegistry[id]) {
-			chartRegistry[id] = echarts.init(dom);
-		}
-
-		chartRegistry[id].setOption(option, true);
-
-		return chartRegistry[id];
-	},
-
-	sortTable: function(table, column) {
-		var tbody = table.querySelector('tbody');
-		if (!tbody) return;
-		var rows = Array.from(tbody.querySelectorAll('tr:not(.table-titles):not(.placeholder)'));
-		var reverse = (currentSortInfo.table === table && currentSortInfo.column === column) ? !currentSortInfo.reverse : false;
-
-		table.querySelectorAll('th').forEach(function(th) {
-			th.classList.remove('th-sort-asc', 'th-sort-desc');
-		});
-
-		var th = table.querySelector('th:nth-child(' + (column + 1) + ')');
-		th.classList.add(reverse ? 'th-sort-desc' : 'th-sort-asc');
-
-		rows.sort(function(row1, row2) {
-			var a = row1.cells[column].getAttribute('data-value') || row1.cells[column].textContent;
-			var b = row2.cells[column].getAttribute('data-value') || row2.cells[column].textContent;
-
-			if (!isNaN(a) && !isNaN(b)) { a = Number(a); b = Number(b); }
-
-			if (a < b) return reverse ? 1 : -1;
-			if (a > b) return reverse ? -1 : 1;
-			return 0;
-		});
-
-		currentSortInfo.table = table;
-		currentSortInfo.column = column;
-		currentSortInfo.reverse = reverse;
-
-		rows.forEach(function(row) { tbody.removeChild(row); });
-		rows.forEach(function(row) { tbody.appendChild(row); });
-	},
-
-	formatMbps: function(bits) {
-		if (typeof bits !== 'number') return '0.00 Mbps';
-		return (bits / 1024 / 1024).toFixed(2) + ' Mbps';
-	},
-
-	formatMB: function(bytes) {
-		if (typeof bytes !== 'number') return '0.00 MB';
-		return (bytes / 1024 / 1024).toFixed(2) + ' MB';
-	},
-
-	renderSIDData: function(data) {
-		var rows = [];
-		var txRateData = [], rxRateData = [];
-		var txVolumeData = [], rxVolumeData = [];
-		var tx_rate_total = 0, rx_rate_total = 0;
-		var tx_bytes_total = 0, rx_bytes_total = 0;
-		var perServiceTxRate = {};
-		var perServiceRxRate = {};
-		var self = this;
-		var allItems = [];
-		
-		if (data && data.status === 'success' && Array.isArray(data.data)) {
-			allItems = data.data;
-			var listSizeEl = document.getElementById('sid-size-select');
-			var listSize = listSizeEl ? parseInt(listSizeEl.value, 10) : 10;
-
-			var activeConnections = allItems.filter(function(item) { return item.incoming.rate > 0 || item.outgoing.rate > 0; });
-			var inactiveConnections = allItems.filter(function(item) { return item.incoming.rate === 0 && item.outgoing.rate === 0; });
-		
-			activeConnections.sort(function(a, b) { return (b.incoming.rate + b.outgoing.rate) - (a.incoming.rate + a.outgoing.rate); });
-			inactiveConnections.sort(function(a, b) { return b.incoming.total_bytes - a.incoming.total_bytes; });
-		
-			var displayData = activeConnections;
-			if (displayData.length < listSize) {
-				displayData = displayData.concat(inactiveConnections.slice(0, listSize - displayData.length));
-			}
-			
-			if (displayData.length > listSize) {
-				displayData = displayData.slice(0, listSize);
-			}
-
-			displayData.forEach(function(item) {
-				var domainOrL7Proto = 'unknown';
-				var lookupInfo = sidLookupTable[item.sid];
-				
-				if (lookupInfo) {
-					domainOrL7Proto = lookupInfo.name;
-				} else if (item.sid_type === 'Domain' && item.domain && item.domain !== 'unknown') {
-					domainOrL7Proto = item.domain;
-				} else if (item.sid_type === 'L7' && item.l7_proto_desc && item.l7_proto_desc !== 'unknown') {
-					domainOrL7Proto = item.l7_proto_desc;
-				}
-				
-				// 判断连接是否活跃
-				var isActive = item.incoming.rate > 0 || item.outgoing.rate > 0;
-				var activityIcon = isActive ? '🟢' : '⚪';
-				
-				rows.push([
-					E('span', { 'class': 'sid-cell' }, [
-						E('span', { 'class': 'activity-indicator', 'title': isActive ? _('Active') : _('Inactive') }, activityIcon),
-						E('span', {}, ' ' + item.sid)
-					]),
-					E('span', { 'class': 'protocol-cell' }, [
-						E('span', { 'class': 'protocol-icon' }, '🌐'),
-						E('span', {}, ' ' + domainOrL7Proto)
-					]),
-					[ item.incoming.rate, E('span', { 'class': 'speed-cell download' }, [
-						E('span', { 'class': 'data-value' }, '%1024.2mbps'.format(item.incoming.rate))
-					])],
-					[ item.incoming.total_bytes, E('span', { 'class': 'volume-cell download' }, [
-						E('span', { 'class': 'data-value' }, '%1024.2mB'.format(item.incoming.total_bytes))
-					])],
-					[ item.incoming.total_packets, E('span', { 'class': 'packet-cell download' }, [
-						E('span', { 'class': 'data-value' }, '%1000.2mP'.format(item.incoming.total_packets))
-					])],
-					[ item.outgoing.rate, E('span', { 'class': 'speed-cell upload' }, [
-						E('span', { 'class': 'data-value' }, '%1024.2mbps'.format(item.outgoing.rate))
-					])],
-					[ item.outgoing.total_bytes, E('span', { 'class': 'volume-cell upload' }, [
-						E('span', { 'class': 'data-value' }, '%1024.2mB'.format(item.outgoing.total_bytes))
-					])],
-					[ item.outgoing.total_packets, E('span', { 'class': 'packet-cell upload' }, [
-						E('span', { 'class': 'data-value' }, '%1000.2mP'.format(item.outgoing.total_packets))
-					])]
-				]);
-
-				txRateData.push({ value: item.incoming.rate, label: domainOrL7Proto });
-				rxRateData.push({ value: item.outgoing.rate, label: domainOrL7Proto });
-				txVolumeData.push({ value: item.incoming.total_bytes, label: domainOrL7Proto });
-				rxVolumeData.push({ value: item.outgoing.total_bytes, label: domainOrL7Proto });
-
-				perServiceTxRate[domainOrL7Proto] = (perServiceTxRate[domainOrL7Proto] || 0) + item.incoming.rate;
-				perServiceRxRate[domainOrL7Proto] = (perServiceRxRate[domainOrL7Proto] || 0) + item.outgoing.rate;
-			});
-
-			allItems.forEach(function(item) {
-				tx_rate_total += item.incoming.rate;
-				rx_rate_total += item.outgoing.rate;
-				tx_bytes_total += item.incoming.total_bytes;
-				rx_bytes_total += item.outgoing.total_bytes;
-			});
-		}
-
-		this.updateStackedLineCharts(perServiceTxRate, perServiceRxRate);
-
-		var table = document.getElementById('sid-data');
-		cbi_update_table('#sid-data', rows, E('em', _('No data recorded yet.')));
-
-		var headers = table.querySelectorAll('th');
-		
-		if (!table.hasAttribute('data-sort-initialized')) {
-			headers.forEach(function(header, index) {
-				header.style.cursor = 'pointer';
-				header.addEventListener('click', function() { self.sortTable(table, index); });
-			});
-			table.setAttribute('data-sort-initialized', 'true');
-		}
-
-		table.querySelectorAll('tr:not(.table-titles):not(.placeholder)').forEach(function(row, rowIndex) {
-			if (!rows[rowIndex]) return;
-			Array.from(row.cells).forEach(function(cell, cellIndex) {
-				if (Array.isArray(rows[rowIndex][cellIndex])) {
-					cell.setAttribute('data-value', rows[rowIndex][cellIndex][0]);
-				}
-			});
-		});
-
-		this.pie('sid-tx-rate-pie', txRateData, function(p) { return p.name + ': ' + self.formatMbps(p.value) + ' (' + p.percent + '%)'; });
-		this.pie('sid-rx-rate-pie', rxRateData, function(p) { return p.name + ': ' + self.formatMbps(p.value) + ' (' + p.percent + '%)'; });
-		this.pie('sid-tx-volume-pie', txVolumeData, function(p) { return p.name + ': ' + self.formatMB(p.value) + ' (' + p.percent + '%)'; });
-		this.pie('sid-rx-volume-pie', rxVolumeData, function(p) { return p.name + ': ' + self.formatMB(p.value) + ' (' + p.percent + '%)'; });
-
-		var sidTotalEl = document.getElementById('sid-total-val');
-		if(sidTotalEl) sidTotalEl.textContent = allItems.length;
-
-		var txRateEl = document.getElementById('sid-tx-rate-val');
-		if(txRateEl) txRateEl.textContent = '%1024.2mbps'.format(tx_rate_total);
-
-		var rxRateEl = document.getElementById('sid-rx-rate-val');
-		if(rxRateEl) rxRateEl.textContent = '%1024.2mbps'.format(rx_rate_total);
-
-		var txVolEl = document.getElementById('sid-tx-volume-val');
-		if(txVolEl) txVolEl.textContent = '%1024.2mB'.format(tx_bytes_total);
-
-		var rxVolEl = document.getElementById('sid-rx-volume-val');
-		if(rxVolEl) rxVolEl.textContent = '%1024.2mB'.format(rx_bytes_total);
-
-		lastUpdated = new Date();
-		var timestampEl = document.getElementById('last-updated');
-		if (timestampEl) {
-			timestampEl.textContent = _('Last updated: %s').format(lastUpdated.toLocaleTimeString());
-		}
-	},
-
-	renderL7ProtoData: function(data) {
-		var rows = [];
-		var self = this;
-		
-		sidLookupTable = {};
-		
-		if (data && data.status === 'success' && data.data) {
-			if (Array.isArray(data.data.protocols)) {
-				data.data.protocols.forEach(function(item) {
-					sidLookupTable[item.sid] = { type: 'protocol', name: item.protocol };
-					rows.push([
-						E('span', { 'class': 'id-cell' }, item.id),
-						E('span', { 'class': 'protocol-cell' }, [
-							E('span', { 'class': 'protocol-icon l7' }, '🔌'),
-							E('span', {}, ' ' + item.protocol)
-						]),
-						E('span', { 'class': 'sid-cell' }, item.sid)
-					]);
-				});
-			}
-			
-			if (Array.isArray(data.data.domains)) {
-				data.data.domains.forEach(function(item) {
-					sidLookupTable[item.sid] = { type: 'domain', name: item.domain };
-					rows.push([
-						E('span', { 'class': 'id-cell' }, item.id),
-						E('span', { 'class': 'protocol-cell' }, [
-							E('span', { 'class': 'protocol-icon domain' }, '🌍'),
-							E('span', {}, ' ' + item.domain)
-						]),
-						E('span', { 'class': 'sid-cell' }, item.sid)
-					]);
-				});
-			}
-		}
-
-		var table = document.getElementById('l7proto-data');
-		var headers = table.querySelectorAll('th');
-		
-		if (!table.hasAttribute('data-sort-initialized')) {
-			headers.forEach(function(header, index) {
-				header.style.cursor = 'pointer';
-				header.addEventListener('click', function() { self.sortTable(table, index); });
-			});
-			table.setAttribute('data-sort-initialized', 'true');
-		}
-
-		cbi_update_table('#l7proto-data', rows, E('em', _('No data recorded yet.')));
-	},
-
-	pollL7Data: function() {
-		if (pollActive) return;
-
-		var self = this;
-		pollActive = true;
-		
-		self.loadL7ProtoData().then(function(l7data) {
-			self.renderL7ProtoData(l7data);
-			return self.loadSIDData();
-		}).then(function(sidData){
-			self.renderSIDData(sidData);
-		});
-
-		poll.add(function() {
-			if (isPaused) return Promise.resolve();
-			
-			return self.loadL7ProtoData().then(function(data) {
-				self.renderL7ProtoData(data);
-			}).then(function() {
-				return self.loadSIDData().then(function(data) {
-					self.renderSIDData(data);
-				});
-			});
-		}, 5);
-	},
-
-	initializeUI: function() {
-		if (window.echarts) {
-			var dlChartEl = document.getElementById('download-speed-line-chart');
-			var ulChartEl = document.getElementById('upload-speed-line-chart');
-			if (!dlChartEl || !ulChartEl) return;
-
-			var baseChartOption = {
-				tooltip: {
-					trigger: 'axis',
-					formatter: function (params) {
-						if (!params || params.length === 0) {
-							return null;
-						}
-						var tooltipContent = params[0].axisValueLabel + '<br/>';
-						params.sort(function(a, b) { return b.value - a.value; });
-						params.forEach(function(item) {
-							if (item.value > 0) {
-								tooltipContent += item.marker + ' ' + item.seriesName + ': ' + '%1024.2mbps'.format(item.value) + '<br/>';
-							}
-						});
-						return tooltipContent;
-					}
-				},
-				grid: { left: '3%', right: '4%', bottom: '10%', top: '50px', containLabel: true },
-				xAxis: { type: 'category', boundaryGap: false, data: lineCategories },
-				yAxis: { type: 'value', axisLabel: { formatter: function(val) { return '%1024.2mbps'.format(val); } } },
-				series: []
-			};
-
-
-		downloadLineChart = echarts.init(dlChartEl);
-		downloadLineChart.setOption(baseChartOption);
-
-		uploadLineChart = echarts.init(ulChartEl);
-		uploadLineChart.setOption(baseChartOption);
-
-		// 添加窗口大小变化监听器，使图表能够响应式调整
-		if (!resizeListenerAdded) {
-			var resizeTimer = null;
-			var resizeHandler = function() {
-				// 使用防抖，避免频繁触发 resize
-				if (resizeTimer) {
-					clearTimeout(resizeTimer);
-				}
-				resizeTimer = setTimeout(function() {
-					// 调整折线图大小
-					if (downloadLineChart) {
-						downloadLineChart.resize();
-					}
-					if (uploadLineChart) {
-						uploadLineChart.resize();
-					}
-					// 调整饼图大小
-					Object.keys(chartRegistry).forEach(function(chartId) {
-						if (chartRegistry[chartId]) {
-							chartRegistry[chartId].resize();
-						}
-					});
-				}, 200);
-			};
-			
-			window.addEventListener('resize', resizeHandler);
-			resizeListenerAdded = true;
-		}
-
-		this.pollL7Data();
-	} else {
-		setTimeout(this.initializeUI.bind(this), 50);
-	}
-},	render: function() {
-		var self = this;
-
-		var controls = E('div', { 'class': 'l7-controls' }, [
-			E('div', { 'class': 'l7-controls-left' }, [
-				E('div', { 'class': 'control-group' }, [
-					E('span', { 'class': 'control-icon' }, '📊'),
-					E('label', { 'for': 'sid-size-select', 'class': 'control-label' }, _('Show entries:')),
-					E('select', {
-						'id': 'sid-size-select',
-						'class': 'cbi-input-select',
-						'change': ui.createHandlerFn(this, function() {
-							if (lastSIDData) {
-								self.renderSIDData(lastSIDData);
-							}
-						})
-					}, [
-						E('option', { 'value': '10' }, '10'),
-						E('option', { 'value': '15' }, '15'),
-						E('option', { 'value': '20' }, '20'),
-						E('option', { 'value': '25' }, '25'),
-						E('option', { 'value': '50' }, '50')
-					])
-				])
-			]),
-			E('div', { 'class': 'l7-controls-right' }, [
-				E('div', { 'class': 'control-group' }, [
-					E('span', { 'class': 'control-icon' }, '🕐'),
-					E('span', { 'id': 'last-updated', 'class': 'last-updated-text' }, _('Last updated: never'))
-				]),
-				E('button', {
-					'class': 'cbi-button cbi-button-action',
-					'id': 'pause-resume-btn',
-					'click': function(ev) {
-						isPaused = !isPaused;
-						var btn = ev.target;
-						if (isPaused) {
-							btn.innerHTML = '<span class="btn-icon">▶️</span> ' + _('Resume');
-							btn.classList.remove('cbi-button-action');
-							btn.classList.add('cbi-button-positive');
-						} else {
-							btn.innerHTML = '<span class="btn-icon">⏸️</span> ' + _('Pause');
-							btn.classList.remove('cbi-button-positive');
-							btn.classList.add('cbi-button-action');
-						}
-					}
-				}, [
-					E('span', { 'class': 'btn-icon' }, '⏸️'),
-					E('span', {}, ' ' + _('Pause'))
-				])
-			])
-		]);
-
-		var tabContainer = E('div', {}, [
-			E('div', { 'class': 'cbi-section', 'data-tab': 'sid', 'data-tab-title': _('L7 SID Data') }, [
-				E('div', { 'class': 'dashboard-container' }, [
-					E('div', { 'class': 'line-chart-row' }, [
-						E('div', { 'class': 'chart-card' }, [
-							E('h4', [_('Real-time Download Speed')]),
-							E('div', { id: 'download-speed-line-chart', style: 'width: 100%; height: 350px;' })
-						]),
-						E('div', { 'class': 'chart-card' }, [
-							E('h4', [_('Real-time Upload Speed')]),
-							E('div', { id: 'upload-speed-line-chart', style: 'width: 100%; height: 350px;' })
-						])
-					]),
-					E('div', { 'class': 'kpi-row' }, [
-						E('div', { 'class': 'kpi-card' }, [ E('big', { id: 'sid-total-val' }, '0'), E('span', { 'class': 'kpi-card-label' }, _('L7 Protocol Data')) ]),
-						E('div', { 'class': 'kpi-card' }, [ E('big', { id: 'sid-tx-rate-val' }, '0'), E('span', { 'class': 'kpi-card-label' }, _('Download Speed')) ]),
-						E('div', { 'class': 'kpi-card' }, [ E('big', { id: 'sid-rx-rate-val' }, '0'), E('span', { 'class': 'kpi-card-label' }, _('Upload Speed')) ]),
-						E('div', { 'class': 'kpi-card' }, [ E('big', { id: 'sid-tx-volume-val' }, '0'), E('span', { 'class': 'kpi-card-label' }, _('Download Total')) ]),
-						E('div', { 'class': 'kpi-card' }, [ E('big', { id: 'sid-rx-volume-val' }, '0'), E('span', { 'class': 'kpi-card-label' }, _('Upload Total')) ])
-					]),
-					E('div', { 'class': 'chart-grid' }, [
-						E('div', { 'class': 'chart-card' }, [
-							E('h4', [_('Download Speed / SID')]),
-							E('div', { id: 'sid-tx-rate-pie', style: 'width: 100%; height: 300px;' })
-						]),
-						E('div', { 'class': 'chart-card' }, [
-							E('h4', [_('Upload Speed / SID')]),
-							E('div', { id: 'sid-rx-rate-pie', style: 'width: 100%; height: 300px;' })
-						]),
-						E('div', { 'class': 'chart-card' }, [
-							E('h4', [_('Download Total')]),
-							E('div', { id: 'sid-tx-volume-pie', style: 'width: 100%; height: 300px;' })
-						]),
-						E('div', { 'class': 'chart-card' }, [
-							E('h4', [_('Upload Total')]),
-							E('div', { id: 'sid-rx-volume-pie', style: 'width: 100%; height: 300px;' })
-						])
-					])
-				]),
-				E('table', { 'class': 'table', 'id': 'sid-data' }, [
-					E('tr', { 'class': 'tr table-titles' }, [
-						E('th', { 'class': 'th left' }, [ E('span', { 'class': 'th-icon' }, '🆔'), ' ', _('SID') ]),
-						E('th', { 'class': 'th left' }, [ E('span', { 'class': 'th-icon' }, '🌐'), ' ', _('Domain&L7Protocol') ]),
-						E('th', { 'class': 'th right' }, [ E('span', { 'class': 'th-icon' }, '⬇️'), ' ', _('Download Speed (Bit/s)') ]),
-						E('th', { 'class': 'th right' }, [ E('span', { 'class': 'th-icon' }, '📦'), ' ', _('Download (Bytes)') ]),
-						E('th', { 'class': 'th right' }, [ E('span', { 'class': 'th-icon' }, '📨'), ' ', _('Download (Packets)') ]),
-						E('th', { 'class': 'th right' }, [ E('span', { 'class': 'th-icon' }, '⬆️'), ' ', _('Upload Speed (Bit/s)') ]),
-						E('th', { 'class': 'th right' }, [ E('span', { 'class': 'th-icon' }, '📦'), ' ', _('Upload (Bytes)') ]),
-						E('th', { 'class': 'th right' }, [ E('span', { 'class': 'th-icon' }, '📨'), ' ', _('Upload (Packets)') ])
-					]),
-					E('tr', { 'class': 'tr placeholder' }, [
-						E('td', { 'class': 'td', 'colspan': '8' }, [
-							E('em', { 'class': 'spinning' }, [ _('Collecting data...') ])
-						])
-					])
-				]),
-				controls
-			]),
-			E('div', { 'class': 'cbi-section', 'data-tab': 'l7proto', 'data-tab-title': _('L7 Protocol Data') }, [
-				E('table', { 'class': 'table', 'id': 'l7proto-data' }, [
-					E('tr', { 'class': 'tr table-titles' }, [
-						E('th', { 'class': 'th left' }, [ E('span', { 'class': 'th-icon' }, '#️⃣'), ' ', _('ID') ]),
-						E('th', { 'class': 'th left' }, [ E('span', { 'class': 'th-icon' }, '🌐'), ' ', _('Domain&L7Protocol') ]),
-						E('th', { 'class': 'th right' }, [ E('span', { 'class': 'th-icon' }, '🔑'), ' ', _('SID') ])
-					]),
-					E('tr', { 'class': 'tr placeholder' }, [
-						E('td', { 'class': 'td', 'colspan': '3' }, [
-							E('em', { 'class': 'spinning' }, [ _('Collecting data...') ])
-						])
-					])
-				])
-			])
-		]);
-
-		var node = E([], [
-		    E('link', { 'rel': 'stylesheet', 'href': L.resource('view/wifidogx.css') }),
-		    E('script', { 'type': 'text/javascript', 'src': L.resource('echarts.min.js') }),
-
-		    E('div', { 'class': 'l7-view-container' }, [
-		        E('h2', [ _('L7 Data Monitor') ]),
-		        E('div', { 'id': 'l7-error-message' }),
-		        tabContainer
-		    ])
-		]);
-
-		ui.tabs.initTabGroup(tabContainer.childNodes);
-
-		setTimeout(this.initializeUI.bind(this), 0);
-
-		return node;
-	},
-
-	handleSave: null,
-	handleSaveApply: null,
-	handleReset: null
-});

luci-app-apfree-wifidog/po/zh_Hans/apfree-wifidog.po

@@ -15,6 +15,9 @@ msgstr ""
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
 
+msgid "Settings"
+msgstr "设置"
+
 msgid "apfree-wifidog"
 msgstr "门户认证"
 
@@ -165,6 +168,9 @@ msgstr "信任的通配符域名"
 msgid "The trusted wildcard domains of the gateway."
 msgstr "网关的信任通配符域名"
 
+msgid "Requires aw-bpf DNS XDP (dns_ringbuf_portal). Patterns like .example.com; resolved IPs are added to the captive portal firewall (inet wifidogx), not inet awbpf."
+msgstr "依赖 aw-bpf 的 DNS XDP（dns_ringbuf_portal）。格式如 .example.com；解析到的 IP 写入门户防火墙 inet wifidogx，不会写入 inet awbpf。"
+
 msgid "App White List"
 msgstr "应用白名单"
 
@@ -228,6 +234,12 @@ msgstr "启用防NAT"
 msgid "Enable Anti NAT devices."
 msgstr "启用防NAT设备"
 
+msgid "Privileged Ops Secret"
+msgstr "特权管控秘钥"
+
+msgid "Local secret required for AWAS cloud platform to dynamically authorize remote OTA, reboot and system changes. Change this from the default on production devices."
+msgstr "AWAS云端管理平台动态授权远程OTA升级、重启及系统配置变更所需的本地安全秘钥。生产环境请修改默认值。"
+
 msgid "TTL Value"
 msgstr "TTL值"
 
@@ -1093,3 +1105,48 @@ msgstr "MQTT认证的用户名。"
 msgid "The password for MQTT authentication."
 msgstr "MQTT认证的密码。"
 
+msgid "Add Authentication Server"
+msgstr "添加认证服务器"
+
+msgid "Enter a unique name for this authentication server profile."
+msgstr "请输入认证服务器配置文件的唯一名称。"
+
+msgid "Add Long Connection Profile"
+msgstr "添加长连接配置"
+
+msgid "Enter a unique name for this long connection profile."
+msgstr "请输入长连接配置文件的唯一名称。"
+
+msgid "Rename Authentication Server"
+msgstr "重命名认证服务器"
+
+msgid "Enter a new unique name for this authentication server profile."
+msgstr "请输入认证服务器配置文件的新名称。"
+
+msgid "Rename Long Connection Profile"
+msgstr "重命名长连接配置"
+
+msgid "Enter a new unique name for this long connection profile."
+msgstr "请输入长连接配置文件的新名称。"
+
+msgid "Please enter a name."
+msgstr "请输入名称。"
+
+msgid "The name \"%s\" already exists in Auth Server profiles. Please choose a different name."
+msgstr "名称\"%s\"已存在于认证服务器配置中，请选择其他名称。"
+
+msgid "The name \"%s\" already exists in Long Connection profiles. Please choose a different name."
+msgstr "名称\"%s\"已存在于长连接配置中，请选择其他名称。"
+
+msgid "Created new authentication server profile \"%s\"."
+msgstr "已创建新的认证服务器配置\"%s\"。"
+
+msgid "Created new long connection profile \"%s\"."
+msgstr "已创建新的长连接配置\"%s\"。"
+
+msgid "Renamed authentication server profile from \"%s\" to \"%s\"."
+msgstr "已将认证服务器配置从\"%s\"重命名为\"%s\"。"
+
+msgid "Renamed long connection profile from \"%s\" to \"%s\"."
+msgstr "已将长连接配置从\"%s\"重命名为\"%s\"。"
+

luci-app-apfree-wifidog/root/etc/uci-defaults/luci-app-apfree-wifidog.sh

@@ -1,6 +0,0 @@
-#!/bin/sh
-[ -f "/etc/config/hostnames" ] || {
-	echo 'config hostname' > /etc/config/hostnames
-}
-
-exit 0

luci-app-apfree-wifidog/root/usr/libexec/rpcd/luci.wifidogx

@@ -70,7 +70,7 @@ case "$1" in
 					json_init
 					json_add_object "result"
 					json_add_string "status" "fail"
-					json_add_string "message" "WAN interface not found. Available interfaces: $(ls /sys/class/net/ | tr '\n' ' ')"
+					json_add_string "message" "WAN interface not found"
 					json_close_object
 					json_dump
 				fi

luci-app-apfree-wifidog/root/usr/share/luci/menu.d/luci-app-apfree-wifidog.json

@@ -3,56 +3,27 @@
 		"title": "apfree-wifidog",
 		"order": 1,
 		"action": {
-			"type": "view",
-			"path": "wifidogx"
+			"type": "firstchild",
+			"recurse": true
 		},
 		"depends": {
 			"acl": [ "luci-app-apfree-wifidog" ]
 		}
 	},
-	"admin/QoS": {
-		"title": "QoS",
-		"order": 20,
-		"action": {
-			"type": "firstchild",
-			"recurse": true
-		}
-	},
-	"admin/QoS/wifidogx": {
-		"title": "Auth User",
-		"order": 2,
-		"action": {
-			"type": "alias",
-			"path": "admin/QoS/wifidogx/display"
-		},
-		"depends": {
-			"acl": [
-				"luci-app-apfree-wifidog"
-			]
-		}
-	},
-	"admin/QoS/wifidogx/display": {
-		"title": "Display",
+	"admin/services/wifidogx/config": {
+		"title": "Settings",
 		"order": 10,
 		"action": {
 			"type": "view",
-			"path": "wifidogx/display"
+			"path": "wifidogx"
 		}
 	},
-	"admin/QoS/wifidogx/status": {
+	"admin/services/wifidogx/status": {
 		"title": "Status",
 		"order": 20,
 		"action": {
 			"type": "view",
 			"path": "wifidogx/status"
 		}
-	},
-	"admin/QoS/xdpi": {
-		"title": "L7 application",
-		"order": 30,
-		"action": {
-			"type": "view",
-			"path": "xdpi/l7"
-		}
 	}
 }

luci-app-apfree-wifidog/root/usr/share/rpcd/acl.d/luci-app-apfree-wifidog.json

@@ -8,14 +8,12 @@
 			},
 			"file": {
 				"/etc/init.d/wifidogx": [ "exec" ],
-				"/usr/bin/wdctlx": [ "exec" ],
-				"/usr/bin/aw-bpfctl": [ "exec" ],
-				"/usr/bin/awk": [ "exec" ]
+				"/usr/bin/wdctlx": [ "exec" ]
 			},
-			"uci": ["wifidogx", "hostnames", "network"]
+			"uci": ["wifidogx", "network"]
 		},
 		"write": {
-			"uci": ["wifidogx", "hostnames"],
+			"uci": ["wifidogx"],
 			"file": {
 				"/etc/wifidogx/*": [ "write" ]
 			}

luci-app-dnsproxy/htdocs/luci-static/resources/view/dnsproxy.js

@@ -385,9 +385,11 @@ return view.extend({
 		so.validate = validateServerValue;
 		so.modalonly = true;
 
-		so = ss.option(form.DynamicList, 'upstream', _('Upstream DNS'));
+		so = ss.option(form.DynamicList, 'upstream', _('Upstream DNS'),
+			_('Allows the use of a specified upstream for specific domain. <a href="%s" target="_blank">Syntax reference</a>.')
+			.format('https://github.com/AdguardTeam/dnsproxy#specifying-upstreams-for-domains'));
 		so.rmempty = false;
-		so.validate = validateServerValue;
+		//so.validate = validateServerValue; // See #11
 		so.modalonly = true;
 
 		so = ss.option(form.DynamicList, 'fallback', _('Fallback DNS'));

luci-app-dnsproxy/po/templates/dnsproxy.pot

@@ -11,6 +11,12 @@ msgstr ""
 msgid "Add DNS profile"
 msgstr ""
 
+#: htdocs/luci-static/resources/view/dnsproxy.js:389
+msgid ""
+"Allows the use of a specified upstream for specific domain. <a href=\"%s\" "
+"target=\"_blank\">Syntax reference</a>."
+msgstr ""
+
 #: htdocs/luci-static/resources/view/dnsproxy.js:285
 msgid "Bogus-NXDOMAIN"
 msgstr ""
@@ -122,7 +128,7 @@ msgstr ""
 msgid "Failed to apply DNS profile: %s"
 msgstr ""
 
-#: htdocs/luci-static/resources/view/dnsproxy.js:393
+#: htdocs/luci-static/resources/view/dnsproxy.js:395
 msgid "Fallback DNS"
 msgstr ""
 

luci-app-fastnet/Makefile

@@ -8,13 +8,12 @@ include $(TOPDIR)/rules.mk
 LUCI_TITLE:=LuCI support for fastnet
 LUCI_DEPENDS:=+fastnet
 LUCI_PKGARCH:=all
-PKG_VERSION:=0.7.2-r1
+PKG_VERSION:=0.7.7-r1
 # PKG_RELEASE MUST be empty for luci.mk
-PKG_RELEASE:=1
+PKG_RELEASE:=2
 LUCI_MINIFY_CSS:=0
 LUCI_MINIFY_JS:=0
 
 include $(TOPDIR)/feeds/luci/luci.mk
 
 # call BuildPackage - OpenWrt buildroot signature
-

luci-app-frpc/Makefile

@@ -4,6 +4,7 @@ include $(TOPDIR)/rules.mk
 
 LUCI_TITLE:=LuCI Support for frp client
 LUCI_DEPENDS:=+luci-base +frpc
+LUCI_EXTRA_DEPENDS:=frpc (>=0.71.0-r2)
 
 PKG_LICENSE:=Apache-2.0
 

luci-app-frpc/htdocs/luci-static/resources/view/frpc.js

@@ -129,6 +129,16 @@
  */
 
 const startupConf = [
+	[form.Flag, 'enabled', _('Enable service'), null,
+	{
+		enabled: '1',
+		disabled: '0',
+		default: '0',
+		rmempty: false,
+		retain: true,
+		remove: writeFlagDisabled
+	}],
+
 	[form.Flag, 'stdout', _('Log stdout'), null,
 	{
 		enabled: '1',
@@ -1412,7 +1422,7 @@ return view.extend({
 				});
 			});
 
-			return E('div', { class: 'cbi-map' },
+			return E('div', {},
 				E('fieldset', { class: 'cbi-section' }, [
 					E('p', { id: 'service_status' }, _('Collecting data ...'))
 				])

luci-app-frps/Makefile

@@ -4,6 +4,7 @@ include $(TOPDIR)/rules.mk
 
 LUCI_TITLE:=LuCI Support for frp server
 LUCI_DEPENDS:=+luci-base +frps
+LUCI_EXTRA_DEPENDS:=frps (>=0.71.0-r2)
 
 PKG_LICENSE:=Apache-2.0
 

luci-app-frps/htdocs/luci-static/resources/view/frps.js

@@ -99,6 +99,16 @@
  */
 
 const startupConf = [
+	[form.Flag, 'enabled', _('Enable service'), null,
+	{
+		enabled: '1',
+		disabled: '0',
+		default: '0',
+		rmempty: false,
+		retain: true,
+		remove: writeFlagDisabled
+	}],
+
 	[form.Flag, 'stdout', _('Log stdout'), null,
 	{
 		enabled: '1',
@@ -520,7 +530,15 @@ const commonTransportConf = [
 const commonTlsQuicConf = [
 	[form.Flag, 'tls_force', _('Force TLS'),
 	_('Only accept TLS-encrypted frpc connections.'),
-	{ datatype: 'bool', default: 'false' }],
+	{
+		enabled: 'true',
+		disabled: 'false',
+		default: 'false',
+		optional: false,
+		rmempty: false,
+		retain: true,
+		remove: writeFlagDisabled
+	}],
 
 	[form.Value, 'tls_cert_file', _('TLS certificate path'),
 	_('Path to the TLS certificate file.'),
@@ -964,7 +982,7 @@ return view.extend({
 				});
 			});
 
-			return E('div', { class: 'cbi-map' },
+			return E('div', {},
 				E('fieldset', { class: 'cbi-section' }, [
 					E('p', { id: 'service_status' }, _('Collecting data ...'))
 				])

luci-app-frps/po/ar/frps.po

@@ -11,185 +11,189 @@ msgstr ""
 "&& n%100<=10 ? 3 : n%100>=11 ? 4 : 5;\n"
 "X-Generator: Weblate 5.17.1-dev\n"
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:982
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:1000
 msgid "Access Control"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:1008
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:1026
 msgid "Add new HTTP plugin..."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:256
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:266
 msgid "Additional auth scopes"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:144
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:154
 msgid "Additional configs"
 msgstr "الاعدادات الإضافية"
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:257
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:267
 msgid "Additional scopes to include authentication information."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:154
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:164
 msgid "Address that frps binds to."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:200
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:210
 msgid "Address that proxy listeners bind to."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:551
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:569
 msgid "Allow ports"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:449
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:459
 msgid "Assets dir"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:350
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:360
 msgid "Audience OIDC tokens should contain."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:978
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:996
 msgid "Authentication"
 msgstr "المصادقة"
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:237
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:247
 msgid "Authentication method"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:238
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:248
 msgid "Authentication method used to authenticate frpc."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:583
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:601
 msgid "Authorized keys file for SSH tunnel gateway."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:153
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:163
 msgid "Bind address"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:157
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:167
 msgid "Bind port"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:969
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:987
 msgid "Collecting data ..."
 msgstr "يتم جمع البيانات..."
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:323
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:333
 msgid "Command arguments passed to token source exec."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:300
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:310
 msgid ""
 "Command used to obtain the token. The init script adds --allow-"
 "unsafe=TokenSourceExec when this source type is used."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:977
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:995
 msgid "Common Settings"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:368
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:378
 msgid "Configuration key: log.level."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:538
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:556
 msgid "Configuration key: transport.quic.keepalivePeriod."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:542
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:560
 msgid "Configuration key: transport.quic.maxIdleTimeout."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:546
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:564
 msgid "Configuration key: transport.quic.maxIncomingStreams."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:227
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:237
 msgid "Custom 404 page"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:507
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:517
 msgid "Detailed errors to client"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:375
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:385
 msgid "Disable log color"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:376
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:386
 msgid "Disable log colors when log output is console."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:264
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:274
 msgid "Disabled"
 msgstr "معطل"
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:220
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:230
 msgid "Do not update traffic when TCPMUX passthrough is enabled."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:224
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:234
 msgid "Domain suffix for subdomain-based HTTP/HTTPS proxies."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:454
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:464
 msgid ""
 "Enable Go pprof debug/profiling endpoints on the web server. It only takes "
 "effect when web server port is set."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:403
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:413
 msgid ""
 "Enable HTTPS for the frps web server. This switch controls whether "
 "webServer.tls.certFile and webServer.tls.keyFile are emitted."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:463
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:473
 msgid "Enable Prometheus"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:480
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:490
 msgid "Enable TCP stream multiplexing. This setting must match frpc."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:453
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:463
 msgid "Enable pprof"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:402
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:102
+msgid "Enable service"
+msgstr ""
+
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:412
 msgid "Enable web HTTPS"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:135
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:145
 msgid "Environment variable"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:755
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:773
 msgid "Environment variable must use KEY=value format."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:333
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:343
 msgid "Environment variables passed to token source exec. Use KEY=value."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:464
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:474
 msgid ""
 "Export Prometheus metrics on webServer /metrics API. It only takes effect "
 "when web server port is set."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:145
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:155
 msgid ""
 "Extra root-level configuration fragments included before generated HTTP "
 "plugin sections. Use raw settings for table-specific extra options."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:521
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:531
 msgid "Force TLS"
 msgstr ""
 
@@ -197,311 +201,315 @@ msgstr ""
 msgid "Grant access to LuCI app frps"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:1003
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:1021
 msgid "HTTP Plugin Settings"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:781
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:799
 msgid "HTTP plugin URL must include a host."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:777
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:795
 msgid "HTTP plugin address must be a single address."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:593
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:807
+msgid "HTTP plugin address must be host:port or an http:// or https:// URL."
+msgstr ""
+
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:611
 msgid "HTTP plugin backend address."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:797
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:815
 msgid ""
 "HTTP plugin operation must be a frps operation name, for example Login or "
 "NewProxy."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:765
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:783
 msgid "HTTP plugin path must start with /."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:604
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:622
 msgid "HTTP plugin request path."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:499
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:509
 msgid "Heartbeat timeout"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:500
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:510
 msgid "Heartbeat timeout in seconds."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:161
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:171
 msgid "KCP bind port"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:174
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:193
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:184
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:203
 msgid "KCP bind port and QUIC bind port must be different."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:492
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:502
 msgid "Keepalive interval for TCP mux."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:261
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:271
 msgid ""
 "Load token from an external source. File reads the token from a local file; "
 "exec runs a command and requires frp unsafe permission. Mutually exclusive "
 "with auth.token."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:984
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:1002
 msgid "Log Settings"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:367
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:377
 msgid "Log level"
 msgstr "مستوى التسجيل"
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:371
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:381
 msgid "Log max days"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:363
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:373
 msgid "Log output"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:364
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:374
 msgid "Log output path or console."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:112
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:122
 msgid "Log stderr"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:102
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:112
 msgid "Log stdout"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:475
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:485
 msgid "Max pool count"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:560
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:578
 msgid "Max ports per client"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:372
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:382
 msgid "Maximum number of days to keep logs."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:476
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:486
 msgid "Maximum pool count for each proxy."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:561
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:579
 msgid "Maximum ports each client can use. 0 means no limit."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:504
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:514
 msgid "Maximum time to wait for a work connection."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:564
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:582
 msgid "NAT hole analysis reserve hours"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:942
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:960
 msgid "NOT RUNNING"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:349
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:359
 msgid "OIDC audience"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:345
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:355
 msgid "OIDC issuer"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:346
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:356
 msgid "OIDC issuer used to verify tokens."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:353
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:363
 msgid "OIDC skip expiry check"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:357
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:367
 msgid "OIDC skip issuer check"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:136
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:146
 msgid "OS environments passed to frp for config file template, see %s."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:522
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:532
 msgid "Only accept TLS-encrypted frpc connections."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:579
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:597
 msgid "Path for auto-generated private key."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:277
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:287
 msgid "Path of token file."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:228
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:238
 msgid "Path to custom 404 page for HTTP requests."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:526
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:544
 msgid "Path to the TLS certificate file."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:530
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:548
 msgid "Path to the TLS private key file."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:414
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:424
 msgid "Path to the certificate file used by the HTTPS web server."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:432
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:442
 msgid "Path to the private key file used by the HTTPS web server."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:534
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:552
 msgid "Path to the trusted CA certificate file."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:592
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:610
 msgid "Plugin address"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:588
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:606
 msgid "Plugin name"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:614
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:632
 msgid "Plugin operations"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:603
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:621
 msgid "Plugin path"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:204
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:214
 msgid "Port for HTTP virtual host requests. Empty or 0 disables it."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:208
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:218
 msgid "Port for HTTPS virtual host requests. Empty or 0 disables it."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:216
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:226
 msgid "Port for TCPMUX HTTP CONNECT requests. Empty or 0 disables it."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:719
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:737
 msgid "Port must be a number between 0 and 65535."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:723
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:741
 msgid "Port must be between 0 and 65535."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:742
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:760
 msgid "Port must be between 1 and 65535."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:745
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:763
 msgid "Port range start must not be greater than end."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:158
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:168
 msgid "Port that frps listens on."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:552
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:570
 msgid ""
 "Ports clients are allowed to bind. Use single port like 3001 or range like "
 "2000-3000."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:575
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:593
 msgid "Private key file for SSH tunnel gateway."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:199
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:209
 msgid "Proxy bind address"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:180
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:190
 msgid "QUIC bind port"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:537
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:555
 msgid "QUIC keepalive period"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:541
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:559
 msgid "QUIC max idle timeout"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:545
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:563
 msgid "QUIC max incoming streams"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:942
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:960
 msgid "RUNNING"
 msgstr "قيد التشغيل"
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:125
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:135
 msgid "Respawn when crashed"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:212
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:222
 msgid "Response header timeout for vhost HTTP server, in seconds."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:565
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:583
 msgid "Retention time for NAT hole punching strategy data."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:123
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:133
 msgid "Run daemon as group"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:122
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:132
 msgid "Run daemon as user"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:983
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:1001
 msgid "SSH Tunnel"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:582
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:600
 msgid "SSH tunnel authorized keys file"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:578
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:596
 msgid "SSH tunnel auto-generated private key path"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:570
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:588
 msgid "SSH tunnel bind port"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:571
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:589
 msgid "SSH tunnel gateway bind port. Empty disables this feature."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:574
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:592
 msgid "SSH tunnel private key file"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:508
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:518
 msgid "Send specific error details to frpc."
 msgstr ""
 
@@ -509,208 +517,208 @@ msgstr ""
 msgid "Server"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:358
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:368
 msgid "Skip checking whether OIDC token issuer matches configured issuer."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:354
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:364
 msgid "Skip checking whether the OIDC token is expired."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:985
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:996
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:1003
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:1014
 msgid "Startup Settings"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:223
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:233
 msgid "Subdomain host"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:495
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:505
 msgid "TCP keepalive"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:496
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:506
 msgid "TCP keepalive interval. Negative value disables keepalive."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:479
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:489
 msgid "TCP mux"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:491
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:501
 msgid "TCP mux keepalive interval"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:215
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:225
 msgid "TCPMUX HTTP CONNECT port"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:219
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:229
 msgid "TCPMUX passthrough"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:980
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:998
 msgid "TLS / QUIC"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:413
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:525
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:423
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:543
 msgid "TLS certificate path"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:425
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:435
 msgid "TLS certificate path is required when web HTTPS is enabled."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:431
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:529
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:441
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:547
 msgid "TLS private key path"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:443
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:453
 msgid "TLS private key path is required when web HTTPS is enabled."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:533
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:551
 msgid "TLS trusted CA path"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:241
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:251
 msgid "Token"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:250
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:270
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:260
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:280
 msgid "Token and token source are mutually exclusive."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:299
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:309
 msgid "Token source command"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:322
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:332
 msgid "Token source command arguments"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:316
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:326
 msgid "Token source command is required when token source type is exec."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:332
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:342
 msgid "Token source environment"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:276
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:286
 msgid "Token source file"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:293
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:303
 msgid "Token source file path is required when token source type is file."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:260
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:270
 msgid "Token source type"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:242
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:252
 msgid "Token used for authentication."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:979
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:997
 msgid "Transport Settings"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:231
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:241
 msgid "UDP packet size"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:232
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:242
 msgid "UDP packet size in bytes. Should match frpc."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:162
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:172
 msgid ""
 "UDP port used for KCP. Empty disables KCP. Do not reuse the same UDP port as "
 "QUIC."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:181
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:191
 msgid ""
 "UDP port used for QUIC. Empty disables QUIC. Do not reuse the same UDP port "
 "as KCP."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:589
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:607
 msgid "Unique HTTP plugin name."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:736
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:754
 msgid "Use a single port like 3001 or a range like 2000-3000."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:503
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:513
 msgid "User connection timeout"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:626
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:644
 msgid "Verify plugin TLS"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:627
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:645
 msgid ""
 "Verify the HTTP plugin TLS certificate when the plugin address uses HTTPS."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:203
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:213
 msgid "Vhost HTTP port"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:211
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:221
 msgid "Vhost HTTP timeout"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:207
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:217
 msgid "Vhost HTTPS port"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:981
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:999
 msgid "Web Server"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:381
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:391
 msgid "Web server address"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:450
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:460
 msgid "Web server assets directory."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:382
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:392
 msgid "Web server bind address."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:395
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:405
 msgid "Web server password"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:396
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:406
 msgid "Web server password."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:385
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:395
 msgid "Web server port"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:386
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:396
 msgid "Web server port. Leave empty or set to 0 to disable the web server."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:389
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:399
 msgid "Web server user"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:390
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:400
 msgid "Web server username."
 msgstr ""
 
@@ -718,11 +726,11 @@ msgstr ""
 msgid "frp"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:945
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:952
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:963
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:970
 msgid "frp Server"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:615
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:633
 msgid "frps operations handled by this HTTP plugin."
 msgstr ""